CVE-2026-74616
Received Received - Intake

Buffer Overrun in Linux Kernel XDP Clone Handling

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: xdp: reject clones that overrun skb_shared_info tailroom xdpf_clone() clones broadcast copies into a single page and sets frame_sz to PAGE_SIZE. __xdp_build_skb_from_frame() later treats that page like a normal XDP frame and expects the usual skb_shared_info tailroom at the end of the buffer. The current check only rejects frames whose linear xdp_frame header, headroom, and packet data exceed PAGE_SIZE. A source frame backed by a larger allocation can still satisfy that check while extending into the clone's required shared-info area. When such a clone is converted back into an skb, build_skb_around() places skb_shared_info over live packet bytes and later writes can corrupt XDP return metadata. Reject clones unless their linear area fits inside SKB_WITH_OVERHEAD(PAGE_SIZE), matching the tailroom requirement already enforced by the XDP-to-skb conversion path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74616
EUVD
EUVD-2026-64553

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the XDP (eXpress Data Path) subsystem where cloned network packets can corrupt memory. When a packet is cloned, the system expects a certain amount of tailroom for metadata. However, a miscalculation allows clones to overrun this space, leading to potential data corruption when the packet is converted back into an skb (socket buffer).

Detection Guidance

This vulnerability is specific to the Linux kernel's XDP (Express Data Path) subsystem and requires kernel-level inspection. Detection involves checking kernel logs for XDP-related errors or crashes, particularly during packet processing or cloning operations. Commands like dmesg, journalctl -k, or checking for kernel oops messages may reveal issues. No direct user-space commands are available for detection as it requires kernel instrumentation.

Impact Analysis

If exploited, this vulnerability could allow an attacker to corrupt kernel memory, potentially causing system crashes, privilege escalation, or unauthorized access. Systems using XDP for network processing, such as high-performance networking or security appliances, are most at risk.

Mitigation Strategies

Apply the latest kernel patches or updates that address this issue. If patches are unavailable, disable XDP features or restrict XDP operations to trusted sources. Monitor kernel logs for signs of exploitation or crashes. Consider updating to a kernel version where this issue is resolved.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74616. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart