Linux EUVD-2026-15367

This vulnerability presents a moderate to high real-world risk despite the absence of a CVSS score and EPSS value. The vulnerability is not listed in the Known Exploited Vulnerabilities (KEV) catalog, indicating no active in-the-wild exploitation has been confirmed. However, proof-of-concept capability exists through the XSK_UMEM__MAX_FRAME_SIZE test case provided in the description, demonstrating reliable reproducibility. The attack vector requires local access and the ability to load and execute XDP/eBPF programs, which is typically restricted to root or CAP_SYS_RESOURCE/CAP_SYS_ADMIN capable users on most systems. This significantly reduces the attack surface compared to remote vulnerabilities. The impact is a denial of service through kernel panic rather than information disclosure or privilege escalation. Systems running Linux with the ice driver (Intel Ethernet devices) and exposed XDP program loading capabilities are at risk, particularly in cloud environments, containers, or systems where unprivileged XDP is enabled. Patch availability through stable kernel commits (b0f05100e8795aadd1c0606bae9caefbda070d63 and e142dc4ef0f451b7ef99d09aaa84e9389af629d7) indicates this is a known, resolved issue, reducing ongoing risk for patched systems.

An attacker with local access and XDP program loading capabilities (root or equivalent capabilities) crafts a custom XDP program that calls bpf_xdp_frags_increase_tail() with large offset values (e.g., XSK_UMEM__MAX_FRAME_SIZE * 100) while processing packets of specific sizes (e.g., 6912 bytes). The vulnerable ice driver's incorrect frag_size calculation causes the tailroom computation to become negative, triggering a kernel panic assertion failure or buffer overflow condition in the XDP frame processing code. This results in immediate denial of service affecting all network traffic processed through that driver instance. While a formal proof-of-concept exists via the xskxceiver test suite referenced in the description, real-world exploitation requires the attacker to first obtain XDP program loading privileges, making this primarily a risk vector in multi-tenant cloud environments, container platforms with permissive capabilities, or systems where unprivileged XDP is explicitly enabled.