{"id":"CVE-2026-74616","revision":"bdd4372eeb4e458fabf336bcf612636f","records":[{"revision":"bdd4372eeb4e458fabf336bcf612636f","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-74616","aliases":[],"title":"xdp: reject clones that overrun skb_shared_info tailroom","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nxdp: reject clones that overrun skb_shared_info tailroom\n\nxdpf_clone() clones broadcast copies into a single page and sets\nframe_sz to PAGE_SIZE. __xdp_build_skb_from_frame() later treats that\npage like a normal XDP frame and expects the usual skb_shared_info\ntailroom at the end of the buffer.\n\nThe current check only rejects frames whose linear xdp_frame header,\nheadroom, and packet data exceed PAGE_SIZE. A source frame backed by a\nlarger allocation can still satisfy that check while extending into the\nclone's required shared-info area. When such a clone is converted back\ninto an skb, build_skb_around() places skb_shared_info over live packet\nbytes and later writes can corrupt XDP return metadata.\n\nReject clones unless their linear area fits inside\nSKB_WITH_OVERHEAD(PAGE_SIZE), matching the tailroom requirement already\nenforced by the XDP-to-skb conversion path.","state":0,"publishedAt":"2026-08-22T15:32:01.313+00:00","modifiedAt":"2026-10-16T19:06:02.219+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/core/xdp.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"e624d4ed4aa8cc3c69d1359b0aaea539203ed266\",\n                            \"lessThan\": \"58408982fa39f9758124cec169f42854d6f98f35\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e624d4ed4aa8cc3c69d1359b0aaea539203ed266\",\n                            \"lessThan\": \"685edea27ac68d08fe4dbd3de74b858d2ad8e830\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e624d4ed4aa8cc3c69d1359b0aaea539203ed266\",\n                            \"lessThan\": \"ba13763d667e008e185fedf592d53846a5b457d1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e624d4ed4aa8cc3c69d1359b0aaea539203ed266\",\n                            \"lessThan\": \"ef4b7c7046d29a67090de15af0da0d1ae8d1b192\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e624d4ed4aa8cc3c69d1359b0aaea539203ed266\",\n                            \"lessThan\": \"fab820f1691a9e26d9031f18aae1e9ce09078f92\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e624d4ed4aa8cc3c69d1359b0aaea539203ed266\",\n                            \"lessThan\": \"f463b6f4957c9c3fd1c75f8d3e5af4879fa609c0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e624d4ed4aa8cc3c69d1359b0aaea539203ed266\",\n                            \"lessThan\": \"e48e8edbef2eb824201495daa5234560f632b23c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/core/xdp.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.14\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.14\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.216\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.183\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.152\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.104\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.45\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.9\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://git.kernel.org/stable/c/58408982fa39f9758124cec169f42854d6f98f35","https://git.kernel.org/stable/c/685edea27ac68d08fe4dbd3de74b858d2ad8e830","https://git.kernel.org/stable/c/ba13763d667e008e185fedf592d53846a5b457d1","https://git.kernel.org/stable/c/ef4b7c7046d29a67090de15af0da0d1ae8d1b192","https://git.kernel.org/stable/c/fab820f1691a9e26d9031f18aae1e9ce09078f92","https://git.kernel.org/stable/c/f463b6f4957c9c3fd1c75f8d3e5af4879fa609c0","https://git.kernel.org/stable/c/e48e8edbef2eb824201495daa5234560f632b23c"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74616","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-74616","identifiers":["CVE-2026-74616"]},"retained":false,"historicalAffected":[]}],"coverage":[]}