EUVD-2026-64352
GHSA-2vgp-f9r9-4w6f
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Exploitation needs an admin-attached fragment-adjusting generic XDP program and a large fragmented path (PR:L, AC:H); impact is kernel memory disclosure (C:H) with no attacker integrity or availability effect.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
net: fix skb length accounting after generic XDP frag adjustment
Generic XDP exposes non-linear skb fragments through an xdp_buff. If an XDP program adjusts the fragment area, bpf_prog_run_generic_xdp() copies xdp_frags_size back to skb->data_len but leaves skb->len containing the old fragment contribution.
After a fragment shrink, this makes skb_headlen() larger than the actual linear area. In the reproduced UDP receive path, __skb_datagram_iter() copied 1024 bytes past the actual linear tail to userspace, starting at struct skb_shared_info. The copied bytes included the affected skb's nr_frags, xdp_frags_size and a kernel pointer from skb_shinfo(skb)->frags[0]. Real packet data was displaced by the same amount and truncated at the end.
Subtract the old data_len before replacing it and add the new data_len afterwards, keeping skb->len and skb->data_len synchronized.
A 60000-byte UDP datagram on a veth pair with MTU 64000 was shortened by 1024 bytes from its fragment area. Before the fix, all 10 runs produced corrupted payloads. After the fix, all 10 runs matched the expected payload exactly.
AnalysisAI
Kernel memory disclosure in the Linux kernel's generic XDP receive path allows leaking of adjacent kernel memory - including skb_shared_info contents and a raw kernel pointer from skb_shinfo(skb)->frags[0] - into userspace when an attached XDP program shrinks a packet's fragment area. The flaw stems from bpf_prog_run_generic_xdp() updating skb->data_len without adjusting skb->len, leaving skb_headlen() larger than the real linear area so datagram copies read past the linear tail. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a generic (software-mode) XDP program to be attached to the receiving interface AND that program to adjust/shrink the packet's fragment area - this is the explicit 'if the XDP program adjusts the fragment area' condition from the description, not a default state. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals conflict and warrant a downward adjustment from the headline number. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | On a host where an administrator has attached a generic-XDP program that shrinks packet fragment areas, an attacker sends a large multi-fragment UDP datagram (as demonstrated with a 60000-byte datagram over a veth pair at MTU 64000). After XDP shrinks the fragment area, the desynchronized skb->len causes the UDP receive path to copy ~1024 bytes past the linear tail into the userspace receiver, leaking skb_shared_info fields and a kernel pointer (useful for defeating KASLR) while corrupting/truncating the real payload. … |
| Remediation | Upgrade to a fixed stable kernel - Vendor-released patch: 6.12.104, 6.18.45, 7.1.9, or 7.2 (choose the fixed release matching your branch), which subtracts the old data_len before replacing it and adds the new data_len afterward to keep skb->len and skb->data_len synchronized; apply the corresponding distribution kernel update once your vendor ships it. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running XDP programs, especially those that adjust packet fragments, and determine exposure scope in your infrastructure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today