CRITICAL Introduced in 4.20
xdp ZcFrame OOB
CVE-2026-81002
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.7MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: xdp: fix zero-copy frame layout xdp_convert_zc_to_xdp_frame() clones an XSK packet into an order-0 page and advertises PAGE_SIZE as its frame size. It allows the copied frame to occupy the page tail needed by skb_shared_info and records zero headroom even when metadata separates the frame header from packet data. An AF_XDP zero-copy packet redirected through cpumap can therefore make the skb overlap skb_shared_info or place it beyond the allocated page. Limit the copied layout to SKB_WITH_OVERHEAD(PAGE_SIZE) and include the metadata length in frame headroom. Redirect callers already handle a NULL conversion result. BUG: KASAN: slab-out-of-bounds in skb_gro_receive Write of size 4 at addr ffff88800cf37004 by task cpumap/1/map:1/146 Call Trace: skb_gro_receive (net/core/gro.c:174) udp_gro_receive (net/ipv4/udp_offload.c:812) inet_gro_receive (net/ipv4/af_inet.c:1539) dev_gro_receive (net/core/gro.c:515) gro_receive_skb (net/core/gro.c:633) cpu_map_kthread_run (kernel/bpf/cpumap.c:395) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:164) ret_from_fork_asm (arch/x86/entry/entry_64.S:255) Kernel panic - not syncing: KASAN: panic_on_warn set ...
02KernelScan AI Analysis
Risk summary
A local attacker with network administration privileges can trigger an out-of-bounds write in the kernel heap by sending a crafted AF_XDP zero-copy packet redirected through a cpumap. The corruption can lead to kernel memory read/write primitives, data corruption, or a kernel panic, affecting system confidentiality, integrity, and availability.
Vulnerability analysis
When an AF_XDP zero-copy packet is redirected through a cpumap, the code that copies the packet into a fresh page incorrectly treats the entire page as usable packet space, failing to reserve the trailing area that the kernel later uses for its own bookkeeping. It also fails to leave space before the packet when metadata sits between the buffer start and the actual data. This allows the packet data to spill into the reserved trailing area or past the end of the page, so when the receiving path later writes its bookkeeping data it does so out of bounds. The fix reduces the usable layout to leave room for that trailing overhead and correctly accounts for any metadata length as leading space; redirect paths already tolerate a failed copy. Triggering this requires local access with the ability to create AF_XDP zero-copy sockets and attach an XDP redirect program to a network interface that supports zero-copy, which demands CAP_NET_ADMIN in the init namespace.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.15 | 4.20 | 5.15.221 | 220927301290 |
| 6.1 | 4.20 | 6.1.188 | ced3e18cd9b9 |
| 6.6 | 4.20 | 6.6.157 | 6de17275b3cc |
| 6.12 | 4.20 | 6.12.109 | 444216dacdbe |
| 6.18 | 4.20 | 6.18.50 | 15d1f3c0dbe7 |
| 7.2 | 4.20 | 7.2.4 | 68d7cc551223 |
| mainline | 4.20 | 7.3-rc1 | 71283aaa6c65 |
| 5.10 | 4.20 | 5.10.270 | dcb6db9ca651 |