Description

In the Linux kernel, the following vulnerability has been resolved: xdp: fix zero-copy frame layout xdp_convert_zc_to_xdp_frame() clones an XSK packet into an order-0 page and advertises PAGE_SIZE as its frame size. It allows the copied frame to occupy the page tail needed by skb_shared_info and records zero headroom even when metadata separates the frame header from packet data. An AF_XDP zero-copy packet redirected through cpumap can therefore make the skb overlap skb_shared_info or place it beyond the allocated page. Limit the copied layout to SKB_WITH_OVERHEAD(PAGE_SIZE) and include the metadata length in frame headroom. Redirect callers already handle a NULL conversion result. BUG: KASAN: slab-out-of-bounds in skb_gro_receive Write of size 4 at addr ffff88800cf37004 by task cpumap/1/map:1/146 Call Trace: skb_gro_receive (net/core/gro.c:174) udp_gro_receive (net/ipv4/udp_offload.c:812) inet_gro_receive (net/ipv4/af_inet.c:1539) dev_gro_receive (net/core/gro.c:515) gro_receive_skb (net/core/gro.c:633) cpu_map_kthread_run (kernel/bpf/cpumap.c:395) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:164) ret_from_fork_asm (arch/x86/entry/entry_64.S:255) Kernel panic - not syncing: KASAN: panic_on_warn set ...

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-11T20:19:08.483Z",
  "pubdate": "2026-09-11T20:19:08.483Z",
  "executiveSummary": "A memory corruption vulnerability exists in the Linux kernel's XDP (eXpress Data Path) subsystem, specifically within the zero-copy (ZC) frame handling mechanism. The flaw is identified as a slab-out-of-bounds write occurring during the conversion of AF_XDP zero-copy packets for redirection via cpumap.\nThe vulnerability is triggered by an incorrect calculation of frame layout when cloning XSK packets into order-0 pages. The kernel fails to account for the necessary overhead required by 'skb_shared_info' and ignores headroom requirements when metadata is present, leading to potential memory overlaps.\nAn attacker capable of injecting AF_XDP packets can leverage this flaw to cause a kernel-level out-of-bounds write when the packet is redirected. This leads to memory corruption, potential kernel panic, and denial-of-service (DoS). Successful exploitation requires specific XDP configurations utilizing zero-copy sockets and cpumap redirection. No authentication is inherently required if the attacker can interact with the network stack via these specialized paths, though local access or elevated privileges to configure XDP maps are typically necessary.",
  "technicalDetails": "The vulnerability resides in the function 'xdp_convert_zc_to_xdp_frame' within the Linux kernel networking subsystem. The function is responsible for converting zero-copy AF_XDP packets into an 'xdp_frame' structure to facilitate redirection to other CPUs via 'cpumap'.\nThe root cause of the vulnerability is an insufficient validation of buffer boundaries. When cloning an XSK packet into an order-0 page, the kernel incorrectly advertises the entire 'PAGE_SIZE' as the available frame size. This calculation fails to reserve space for the 'skb_shared_info' structure—a critical component stored at the end of an skb's data area that tracks fragmentation, metadata, and offload info. Furthermore, the implementation fails to account for frame headroom when metadata is present between the header and packet data.\nUnder these conditions, a packet redirected through cpumap is processed by 'skb_gro_receive'. Because the frame is placed such that it potentially overlaps with the 'skb_shared_info' area or extends beyond the allocated 'PAGE_SIZE', the subsequent kernel processing logic treats the out-of-bounds memory as valid space for skb structure updates. The KASAN (Kernel Address Sanitizer) trace indicates an out-of-bounds write of 4 bytes occurring at 'skb_gro_receive', confirming that the kernel attempts to write control data into memory regions outside the authorized frame boundaries.\nThe attack flow follows these steps: 1) The user configures an AF_XDP zero-copy socket. 2) A packet is injected into the interface. 3) The XDP program triggers a redirection to a cpumap. 4) 'xdp_convert_zc_to_xdp_frame' prepares the frame using the flawed layout calculation, failing to leave adequate space for 'skb_shared_info'. 5) Upon arrival at the cpumap kthread, 'skb_gro_receive' attempts to perform generic receive offload (GRO) operations on the packet. 6) The kernel performs a write operation that exceeds the bounds of the page buffer, resulting in memory corruption and triggering a KASAN crash."
}