Linux Kernel EUVD-2026-28770

Exploitation requires the target system to use Mellanox/NVIDIA ConnectX series network adapters with the mlx5_core driver loaded AND have XDP multi-buffer programs actively attached to the network interface (via 'ip link set dev <interface> xdpgeneric/xdpdrv/xdpoffload') AND be running vulnerable kernel versions 6.18 through 6.19.8 in legacy RQ mode. The attacker must craft packets with specific payload sizes (demonstrated with 3600-byte payloads) that trigger XDP helper functions bpf_xdp_pull_data() or bpf_xdp_adjust_tail() within the loaded XDP program logic - this requires knowledge of the deployed XDP program's behavior. Limiting factors: XDP multi-buffer support is an advanced feature typically deployed only in high-performance networking environments (CDN edge nodes, DDoS mitigation appliances, specialized packet processing infrastructure), not standard server or desktop configurations. Default Linux installations do not load XDP programs. The vulnerability triggers warnings and reference counting errors rather than immediate crashes, and full denial of service requires subsequent interface management operations to manifest the corrupted state.

Real-world risk is LOW despite CVSS 7.5 (High) rating. CVSS vector AV:N indicates network-based exploitation with AC:L (low complexity) and PR:N (no authentication), suggesting easy remote exploitation. However, multiple limiting factors reduce practical risk: (1) Requires specific hardware - mlx5 NICs from Mellanox/NVIDIA, not universally deployed; (2) Requires XDP multi-buffer programs actively loaded on the interface, an advanced networking configuration uncommon in default deployments; (3) Requires crafting packets that trigger specific XDP helper functions (bpf_xdp_pull_data/bpf_xdp_adjust_tail) with particular payload sizes; (4) Impact limited to denial of service (A:H) with no confidentiality or integrity impact (C:N/I:N) - kernel warning and potential interface disruption, not arbitrary code execution. EPSS score of 0.02% (4th percentile) confirms security community assessment of low exploitation likelihood. CISA KEV status is NOT present, indicating no observed active exploitation. The vulnerability was discovered through internal kernel selftests (test_xdp_native_adjst_tail_shrnk_data) rather than real-world attacks. For most organizations, this is a standard patch-cycle priority unless running high-performance networking infrastructure with XDP-enabled mlx5 adapters.

An attacker sends specially crafted network packets with 3600-byte payloads to a Linux system with mlx5 network adapter running XDP multi-buffer programs. The packets are designed to trigger bpf_xdp_adjust_tail() calls that shrink packet data by 256 bytes, causing the XDP runtime to release the last buffer fragment. Due to the driver bug, this released fragment is not tracked in the driver's accounting, creating a page pool reference count underflow. When the network administrator attempts routine interface operations like MTU changes (ip link set dev eth0 mtu 1400), the mlx5 driver's RQ cleanup code encounters negative reference counts and triggers kernel warnings or panics, forcing interface failure or requiring system reboot to restore networking functionality.