GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-74616 (GCVE-0-2026-74616)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:32 – Updated: 2026-08-25 05:40
VLAI
Title
xdp: reject clones that overrun skb_shared_info tailroom
Summary
In the Linux kernel, the following vulnerability has been resolved: xdp: reject clones that overrun skb_shared_info tailroom xdpf_clone() clones broadcast copies into a single page and sets frame_sz to PAGE_SIZE. __xdp_build_skb_from_frame() later treats that page like a normal XDP frame and expects the usual skb_shared_info tailroom at the end of the buffer. The current check only rejects frames whose linear xdp_frame header, headroom, and packet data exceed PAGE_SIZE. A source frame backed by a larger allocation can still satisfy that check while extending into the clone's required shared-info area. When such a clone is converted back into an skb, build_skb_around() places skb_shared_info over live packet bytes and later writes can corrupt XDP return metadata. Reject clones unless their linear area fits inside SKB_WITH_OVERHEAD(PAGE_SIZE), matching the tailroom requirement already enforced by the XDP-to-skb conversion path.
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e624d4ed4aa8cc3c69d1359b0aaea539203ed266 , < 58408982fa39f9758124cec169f42854d6f98f35 (git)
Affected: e624d4ed4aa8cc3c69d1359b0aaea539203ed266 , < 685edea27ac68d08fe4dbd3de74b858d2ad8e830 (git)
Affected: e624d4ed4aa8cc3c69d1359b0aaea539203ed266 , < ba13763d667e008e185fedf592d53846a5b457d1 (git)
Affected: e624d4ed4aa8cc3c69d1359b0aaea539203ed266 , < ef4b7c7046d29a67090de15af0da0d1ae8d1b192 (git)
Affected: e624d4ed4aa8cc3c69d1359b0aaea539203ed266 , < fab820f1691a9e26d9031f18aae1e9ce09078f92 (git)
Affected: e624d4ed4aa8cc3c69d1359b0aaea539203ed266 , < f463b6f4957c9c3fd1c75f8d3e5af4879fa609c0 (git)
Affected: e624d4ed4aa8cc3c69d1359b0aaea539203ed266 , < e48e8edbef2eb824201495daa5234560f632b23c (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.14
Unaffected: 0 , < 5.14 (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.152 , ≤ 6.6.* (semver)
Unaffected: 6.12.104 , ≤ 6.12.* (semver)
Unaffected: 6.18.45 , ≤ 6.18.* (semver)
Unaffected: 7.1.9 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/xdp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "58408982fa39f9758124cec169f42854d6f98f35",
              "status": "affected",
              "version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
              "versionType": "git"
            },
            {
              "lessThan": "685edea27ac68d08fe4dbd3de74b858d2ad8e830",
              "status": "affected",
              "version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
              "versionType": "git"
            },
            {
              "lessThan": "ba13763d667e008e185fedf592d53846a5b457d1",
              "status": "affected",
              "version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
              "versionType": "git"
            },
            {
              "lessThan": "ef4b7c7046d29a67090de15af0da0d1ae8d1b192",
              "status": "affected",
              "version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
              "versionType": "git"
            },
            {
              "lessThan": "fab820f1691a9e26d9031f18aae1e9ce09078f92",
              "status": "affected",
              "version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
              "versionType": "git"
            },
            {
              "lessThan": "f463b6f4957c9c3fd1c75f8d3e5af4879fa609c0",
              "status": "affected",
              "version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
              "versionType": "git"
            },
            {
              "lessThan": "e48e8edbef2eb824201495daa5234560f632b23c",
              "status": "affected",
              "version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/xdp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxdp: reject clones that overrun skb_shared_info tailroom\n\nxdpf_clone() clones broadcast copies into a single page and sets\nframe_sz to PAGE_SIZE. __xdp_build_skb_from_frame() later treats that\npage like a normal XDP frame and expects the usual skb_shared_info\ntailroom at the end of the buffer.\n\nThe current check only rejects frames whose linear xdp_frame header,\nheadroom, and packet data exceed PAGE_SIZE. A source frame backed by a\nlarger allocation can still satisfy that check while extending into the\nclone\u0027s required shared-info area. When such a clone is converted back\ninto an skb, build_skb_around() places skb_shared_info over live packet\nbytes and later writes can corrupt XDP return metadata.\n\nReject clones unless their linear area fits inside\nSKB_WITH_OVERHEAD(PAGE_SIZE), matching the tailroom requirement already\nenforced by the XDP-to-skb conversion path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Remote packets on an XDP ingress netdev whose program calls bpf_xdp_redirect_map() with BPF_F_BROADCAST reach xdpf_clone() through dev_map_enqueue_multi(); edge L4 load balancers and container fan-out to veth peers are common deployments where cloned frames later hit __xdp_build_skb_from_frame() without any local attacker access.\nAC:L - Once broadcast devmap redirect is deployed, an attacker can reliably craft linear frames whose headroom plus payload fall in the SKB_WITH_OVERHEAD(PAGE_SIZE)..PAGE_SIZE window; no race, timing luck, or uncontrollable memory layout is required and the condition can be retried with each packet.\nPR:N - Loading/attaching the XDP program and populating the devmap requires CAP_BPF and CAP_NET_ADMIN on the host, but an unauthenticated remote sender on the already-configured datapath needs no privileges on the victim system, matching the CNA pattern used for the related devmap broadcast clone issue CVE-2026-64355.\nUI:N - Exploitation is driven entirely by network traffic processed in NAPI/softirq after XDP redirect; no victim mount, file open, or other interactive action is required beyond packets reaching the configured interface.\nS:U - The flaw corrupts skb_shared_info placement and metadata within the host kernel address space during skb construction; it does not inherently cross VM, hypervisor, or IOMMU security boundaries.\nC:H - build_skb_around() places skb_shared_info over live packet bytes and memset initializes it there; subsequent skb/shinfo access can read kernel metadata and adjacent buffer contents beyond intended bounds, constituting exploitable out-of-bounds memory disclosure.\nI:H - Overlapping skb_shared_info tailroom lets kernel writes corrupt packet data and lets attacker-influenced bytes corrupt shinfo fields used by later stack, GRO, and transmit paths, giving an out-of-bounds write primitive over frame metadata.\nA:H - Tailroom overlap during __xdp_build_skb_from_frame() can fault or corrupt state during skb construction and downstream processing, producing kernel oops/panic; an attacker can trigger this repeatedly with crafted packets on the broadcast redirect path."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:40:43.432Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/58408982fa39f9758124cec169f42854d6f98f35"
        },
        {
          "url": "https://git.kernel.org/stable/c/685edea27ac68d08fe4dbd3de74b858d2ad8e830"
        },
        {
          "url": "https://git.kernel.org/stable/c/ba13763d667e008e185fedf592d53846a5b457d1"
        },
        {
          "url": "https://git.kernel.org/stable/c/ef4b7c7046d29a67090de15af0da0d1ae8d1b192"
        },
        {
          "url": "https://git.kernel.org/stable/c/fab820f1691a9e26d9031f18aae1e9ce09078f92"
        },
        {
          "url": "https://git.kernel.org/stable/c/f463b6f4957c9c3fd1c75f8d3e5af4879fa609c0"
        },
        {
          "url": "https://git.kernel.org/stable/c/e48e8edbef2eb824201495daa5234560f632b23c"
        }
      ],
      "title": "xdp: reject clones that overrun skb_shared_info tailroom",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74616",
    "datePublished": "2026-08-22T15:32:01.313Z",
    "dateReserved": "2026-08-15T05:44:03.920Z",
    "dateUpdated": "2026-08-25T05:40:43.432Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74616",
      "date": "2026-09-16",
      "epss": "0.00513",
      "percentile": "0.42444"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-11T01:46:53.000Z",
      "cve": "CVE-2026-74616",
      "id": "msrc_CVE-2026-74616",
      "initial_release_date": "2026-08-24T01:03:41.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "xdp: reject clones that overrun skb_shared_info tailroom",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74616.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74616\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-22T16:16:34.280\",\"lastModified\":\"2026-08-25T06:18:39.963\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nxdp: reject clones that overrun skb_shared_info tailroom\\n\\nxdpf_clone() clones broadcast copies into a single page and sets\\nframe_sz to PAGE_SIZE. __xdp_build_skb_from_frame() later treats that\\npage like a normal XDP frame and expects the usual skb_shared_info\\ntailroom at the end of the buffer.\\n\\nThe current check only rejects frames whose linear xdp_frame header,\\nheadroom, and packet data exceed PAGE_SIZE. A source frame backed by a\\nlarger allocation can still satisfy that check while extending into the\\nclone\u0027s required shared-info area. When such a clone is converted back\\ninto an skb, build_skb_around() places skb_shared_info over live packet\\nbytes and later writes can corrupt XDP return metadata.\\n\\nReject clones unless their linear area fits inside\\nSKB_WITH_OVERHEAD(PAGE_SIZE), matching the tailroom requirement already\\nenforced by the XDP-to-skb conversion path.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/core/xdp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"e624d4ed4aa8cc3c69d1359b0aaea539203ed266\",\"lessThan\":\"58408982fa39f9758124cec169f42854d6f98f35\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e624d4ed4aa8cc3c69d1359b0aaea539203ed266\",\"lessThan\":\"685edea27ac68d08fe4dbd3de74b858d2ad8e830\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e624d4ed4aa8cc3c69d1359b0aaea539203ed266\",\"lessThan\":\"ba13763d667e008e185fedf592d53846a5b457d1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e624d4ed4aa8cc3c69d1359b0aaea539203ed266\",\"lessThan\":\"ef4b7c7046d29a67090de15af0da0d1ae8d1b192\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e624d4ed4aa8cc3c69d1359b0aaea539203ed266\",\"lessThan\":\"fab820f1691a9e26d9031f18aae1e9ce09078f92\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e624d4ed4aa8cc3c69d1359b0aaea539203ed266\",\"lessThan\":\"f463b6f4957c9c3fd1c75f8d3e5af4879fa609c0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e624d4ed4aa8cc3c69d1359b0aaea539203ed266\",\"lessThan\":\"e48e8edbef2eb824201495daa5234560f632b23c\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/core/xdp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.216\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.183\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.152\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.104\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.45\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.9\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/58408982fa39f9758124cec169f42854d6f98f35\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/685edea27ac68d08fe4dbd3de74b858d2ad8e830\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ba13763d667e008e185fedf592d53846a5b457d1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e48e8edbef2eb824201495daa5234560f632b23c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ef4b7c7046d29a67090de15af0da0d1ae8d1b192\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f463b6f4957c9c3fd1c75f8d3e5af4879fa609c0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fab820f1691a9e26d9031f18aae1e9ce09078f92\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-25T06:02:53+00:00",
      "cve": "CVE-2026-74616",
      "id": "CVE-2026-74616",
      "initial_release_date": "2026-08-22T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: xdp: reject clones that overrun skb_shared_info tailroom",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74616.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-15T01:17:44Z",
      "cve": "CVE-2026-74616",
      "id": "CVE-2026-74616",
      "initial_release_date": "2026-08-23T00:05:53Z",
      "product_status:first_fixed": "69",
      "product_status:known_affected": "214",
      "product_status:known_not_affected": "143",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74616",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74616.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Loading…

Detection rules are retrieved from Rulezet.

Loading…

Loading…

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.


Loading…