EUVD-2026-64553
GHSA-x7hh-pf5f-27mw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Triggered by packets on an interface (AV:A) only when a non-default XDP broadcast-redirect config exists (AC:H); attacker sends frames without auth (PR:N); impact is kernel memory corruption, mainly integrity/availability with limited confidentiality.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
xdp: reject clones that overrun skb_shared_info tailroom
xdpf_clone() clones broadcast copies into a single page and sets frame_sz to PAGE_SIZE. __xdp_build_skb_from_frame() later treats that page like a normal XDP frame and expects the usual skb_shared_info tailroom at the end of the buffer.
The current check only rejects frames whose linear xdp_frame header, headroom, and packet data exceed PAGE_SIZE. A source frame backed by a larger allocation can still satisfy that check while extending into the clone's required shared-info area. When such a clone is converted back into an skb, build_skb_around() places skb_shared_info over live packet bytes and later writes can corrupt XDP return metadata.
Reject clones unless their linear area fits inside SKB_WITH_OVERHEAD(PAGE_SIZE), matching the tailroom requirement already enforced by the XDP-to-skb conversion path.
AnalysisAI
Memory corruption in the Linux kernel's XDP (eXpress Data Path) broadcast-redirect path allows corruption of kernel skb_shared_info metadata when cloned XDP frames are converted back into socket buffers. xdpf_clone() packs broadcast copies into a single page with frame_sz set to PAGE_SIZE, but the existing bounds check fails to account for the shared-info tailroom, so a source frame from a larger allocation can extend into the clone's required shared-info area; build_skb_around() then writes skb_shared_info over live packet bytes. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target host to be running an XDP program that performs broadcast redirect (bpf_redirect_map with the broadcast flag), which drives the xdpf_clone() single-page clone path - this is the exact feature/configuration prerequisite, not a default setting. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals here conflict sharply and should be reconciled before prioritization. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An operator runs a Linux host with an XDP program performing broadcast redirect (e.g. a software switch/router or multicast fan-out appliance). … |
| Remediation | Vendor-released patch: upgrade to a fixed stable kernel - 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, or 7.2 (or later on the corresponding branch), matching your distribution's backport. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory which systems have XDP broadcast-redirect enabled by checking kernel configuration and active BPF programs-this typically affects specialized packet-processing or load-balancing infrastructure rather than general servers. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today