Vulnerability-Lookup

CVE-2026-74616 (GCVE-0-2026-74616)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:32 – Updated: 2026-08-22 15:32

Title

xdp: reject clones that overrun skb_shared_info tailroom

Summary

In the Linux kernel, the following vulnerability has been resolved: xdp: reject clones that overrun skb_shared_info tailroom xdpf_clone() clones broadcast copies into a single page and sets frame_sz to PAGE_SIZE. __xdp_build_skb_from_frame() later treats that page like a normal XDP frame and expects the usual skb_shared_info tailroom at the end of the buffer. The current check only rejects frames whose linear xdp_frame header, headroom, and packet data exceed PAGE_SIZE. A source frame backed by a larger allocation can still satisfy that check while extending into the clone's required shared-info area. When such a clone is converted back into an skb, build_skb_around() places skb_shared_info over live packet bytes and later writes can corrupt XDP return metadata. Reject clones unless their linear area fits inside SKB_WITH_OVERHEAD(PAGE_SIZE), matching the tailroom requirement already enforced by the XDP-to-skb conversion path.

Severity

No CVSS data available.

Assigner

Linux mitre root

References

7 references

URL	Tags
https://git.kernel.org/stable/c/58408982fa39f9758…
https://git.kernel.org/stable/c/685edea27ac68d08f…
https://git.kernel.org/stable/c/ba13763d667e008e1…
https://git.kernel.org/stable/c/ef4b7c7046d29a670…
https://git.kernel.org/stable/c/fab820f1691a9e26d…
https://git.kernel.org/stable/c/f463b6f4957c9c3fd…
https://git.kernel.org/stable/c/e48e8edbef2eb8242…

Impacted products

2 products

Vendor	Product	Version	CPE status
Linux	Linux	Affected: e624d4ed4aa8cc3c69d1359b0aaea539203ed266 , < 58408982fa39f9758124cec169f42854d6f98f35 (git) Affected: e624d4ed4aa8cc3c69d1359b0aaea539203ed266 , < 685edea27ac68d08fe4dbd3de74b858d2ad8e830 (git) Affected: e624d4ed4aa8cc3c69d1359b0aaea539203ed266 , < ba13763d667e008e185fedf592d53846a5b457d1 (git) Affected: e624d4ed4aa8cc3c69d1359b0aaea539203ed266 , < ef4b7c7046d29a67090de15af0da0d1ae8d1b192 (git) Affected: e624d4ed4aa8cc3c69d1359b0aaea539203ed266 , < fab820f1691a9e26d9031f18aae1e9ce09078f92 (git) Affected: e624d4ed4aa8cc3c69d1359b0aaea539203ed266 , < f463b6f4957c9c3fd1c75f8d3e5af4879fa609c0 (git) Affected: e624d4ed4aa8cc3c69d1359b0aaea539203ed266 , < e48e8edbef2eb824201495daa5234560f632b23c (git)	guessed
Linux	Linux	Affected: 5.14 Unaffected: 0 , < 5.14 (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/xdp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "58408982fa39f9758124cec169f42854d6f98f35",
              "status": "affected",
              "version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
              "versionType": "git"
            },
            {
              "lessThan": "685edea27ac68d08fe4dbd3de74b858d2ad8e830",
              "status": "affected",
              "version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
              "versionType": "git"
            },
            {
              "lessThan": "ba13763d667e008e185fedf592d53846a5b457d1",
              "status": "affected",
              "version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
              "versionType": "git"
            },
            {
              "lessThan": "ef4b7c7046d29a67090de15af0da0d1ae8d1b192",
              "status": "affected",
              "version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
              "versionType": "git"
            },
            {
              "lessThan": "fab820f1691a9e26d9031f18aae1e9ce09078f92",
              "status": "affected",
              "version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
              "versionType": "git"
            },
            {
              "lessThan": "f463b6f4957c9c3fd1c75f8d3e5af4879fa609c0",
              "status": "affected",
              "version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
              "versionType": "git"
            },
            {
              "lessThan": "e48e8edbef2eb824201495daa5234560f632b23c",
              "status": "affected",
              "version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/xdp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxdp: reject clones that overrun skb_shared_info tailroom\n\nxdpf_clone() clones broadcast copies into a single page and sets\nframe_sz to PAGE_SIZE. __xdp_build_skb_from_frame() later treats that\npage like a normal XDP frame and expects the usual skb_shared_info\ntailroom at the end of the buffer.\n\nThe current check only rejects frames whose linear xdp_frame header,\nheadroom, and packet data exceed PAGE_SIZE. A source frame backed by a\nlarger allocation can still satisfy that check while extending into the\nclone\u0027s required shared-info area. When such a clone is converted back\ninto an skb, build_skb_around() places skb_shared_info over live packet\nbytes and later writes can corrupt XDP return metadata.\n\nReject clones unless their linear area fits inside\nSKB_WITH_OVERHEAD(PAGE_SIZE), matching the tailroom requirement already\nenforced by the XDP-to-skb conversion path."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-22T15:32:01.313Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/58408982fa39f9758124cec169f42854d6f98f35"
        },
        {
          "url": "https://git.kernel.org/stable/c/685edea27ac68d08fe4dbd3de74b858d2ad8e830"
        },
        {
          "url": "https://git.kernel.org/stable/c/ba13763d667e008e185fedf592d53846a5b457d1"
        },
        {
          "url": "https://git.kernel.org/stable/c/ef4b7c7046d29a67090de15af0da0d1ae8d1b192"
        },
        {
          "url": "https://git.kernel.org/stable/c/fab820f1691a9e26d9031f18aae1e9ce09078f92"
        },
        {
          "url": "https://git.kernel.org/stable/c/f463b6f4957c9c3fd1c75f8d3e5af4879fa609c0"
        },
        {
          "url": "https://git.kernel.org/stable/c/e48e8edbef2eb824201495daa5234560f632b23c"
        }
      ],
      "title": "xdp: reject clones that overrun skb_shared_info tailroom",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74616",
    "datePublished": "2026-08-22T15:32:01.313Z",
    "dateReserved": "2026-08-15T05:44:03.920Z",
    "dateUpdated": "2026-08-22T15:32:01.313Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74616",
      "date": "2026-08-24",
      "epss": "0.00173",
      "percentile": "0.06704"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-24T01:03:41.000Z",
      "cve": "CVE-2026-74616",
      "id": "msrc_CVE-2026-74616",
      "initial_release_date": "2026-08-24T01:03:41.000Z",
      "product_status:under_investigation": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "xdp: reject clones that overrun skb_shared_info tailroom",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74616.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74616\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-22T16:16:34.280\",\"lastModified\":\"2026-08-22T16:16:34.280\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nxdp: reject clones that overrun skb_shared_info tailroom\\n\\nxdpf_clone() clones broadcast copies into a single page and sets\\nframe_sz to PAGE_SIZE. __xdp_build_skb_from_frame() later treats that\\npage like a normal XDP frame and expects the usual skb_shared_info\\ntailroom at the end of the buffer.\\n\\nThe current check only rejects frames whose linear xdp_frame header,\\nheadroom, and packet data exceed PAGE_SIZE. A source frame backed by a\\nlarger allocation can still satisfy that check while extending into the\\nclone\u0027s required shared-info area. When such a clone is converted back\\ninto an skb, build_skb_around() places skb_shared_info over live packet\\nbytes and later writes can corrupt XDP return metadata.\\n\\nReject clones unless their linear area fits inside\\nSKB_WITH_OVERHEAD(PAGE_SIZE), matching the tailroom requirement already\\nenforced by the XDP-to-skb conversion path.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/core/xdp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"e624d4ed4aa8cc3c69d1359b0aaea539203ed266\",\"lessThan\":\"58408982fa39f9758124cec169f42854d6f98f35\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e624d4ed4aa8cc3c69d1359b0aaea539203ed266\",\"lessThan\":\"685edea27ac68d08fe4dbd3de74b858d2ad8e830\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e624d4ed4aa8cc3c69d1359b0aaea539203ed266\",\"lessThan\":\"ba13763d667e008e185fedf592d53846a5b457d1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e624d4ed4aa8cc3c69d1359b0aaea539203ed266\",\"lessThan\":\"ef4b7c7046d29a67090de15af0da0d1ae8d1b192\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e624d4ed4aa8cc3c69d1359b0aaea539203ed266\",\"lessThan\":\"fab820f1691a9e26d9031f18aae1e9ce09078f92\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e624d4ed4aa8cc3c69d1359b0aaea539203ed266\",\"lessThan\":\"f463b6f4957c9c3fd1c75f8d3e5af4879fa609c0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e624d4ed4aa8cc3c69d1359b0aaea539203ed266\",\"lessThan\":\"e48e8edbef2eb824201495daa5234560f632b23c\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/core/xdp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.216\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.183\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.152\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.104\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.45\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.9\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/58408982fa39f9758124cec169f42854d6f98f35\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/685edea27ac68d08fe4dbd3de74b858d2ad8e830\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ba13763d667e008e185fedf592d53846a5b457d1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e48e8edbef2eb824201495daa5234560f632b23c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ef4b7c7046d29a67090de15af0da0d1ae8d1b192\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f463b6f4957c9c3fd1c75f8d3e5af4879fa609c0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fab820f1691a9e26d9031f18aae1e9ce09078f92\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-24T14:20:39+00:00",
      "cve": "CVE-2026-74616",
      "id": "CVE-2026-74616",
      "initial_release_date": "2026-08-22T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: xdp: reject clones that overrun skb_shared_info tailroom",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74616.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "not set",
      "current_release_date": "2026-08-23T00:05:53Z",
      "cve": "CVE-2026-74616",
      "id": "CVE-2026-74616",
      "initial_release_date": "2026-08-23T00:05:53Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74616",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74616.json",
      "version": "2"
    }
  }
}

FKIE_CVE-2026-74616

Vulnerability from fkie_nvd - Published: 2026-08-22 16:16 - Updated: 2026-08-22 16:16

Severity

Summary

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/58408982fa39f9758124cec169f42854d6f98f35
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/685edea27ac68d08fe4dbd3de74b858d2ad8e830
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/ba13763d667e008e185fedf592d53846a5b457d1
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/e48e8edbef2eb824201495daa5234560f632b23c
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/ef4b7c7046d29a67090de15af0da0d1ae8d1b192
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/f463b6f4957c9c3fd1c75f8d3e5af4879fa609c0
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/fab820f1691a9e26d9031f18aae1e9ce09078f92

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/xdp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "58408982fa39f9758124cec169f42854d6f98f35",
              "status": "affected",
              "version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
              "versionType": "git"
            },
            {
              "lessThan": "685edea27ac68d08fe4dbd3de74b858d2ad8e830",
              "status": "affected",
              "version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
              "versionType": "git"
            },
            {
              "lessThan": "ba13763d667e008e185fedf592d53846a5b457d1",
              "status": "affected",
              "version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
              "versionType": "git"
            },
            {
              "lessThan": "ef4b7c7046d29a67090de15af0da0d1ae8d1b192",
              "status": "affected",
              "version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
              "versionType": "git"
            },
            {
              "lessThan": "fab820f1691a9e26d9031f18aae1e9ce09078f92",
              "status": "affected",
              "version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
              "versionType": "git"
            },
            {
              "lessThan": "f463b6f4957c9c3fd1c75f8d3e5af4879fa609c0",
              "status": "affected",
              "version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
              "versionType": "git"
            },
            {
              "lessThan": "e48e8edbef2eb824201495daa5234560f632b23c",
              "status": "affected",
              "version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/xdp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxdp: reject clones that overrun skb_shared_info tailroom\n\nxdpf_clone() clones broadcast copies into a single page and sets\nframe_sz to PAGE_SIZE. __xdp_build_skb_from_frame() later treats that\npage like a normal XDP frame and expects the usual skb_shared_info\ntailroom at the end of the buffer.\n\nThe current check only rejects frames whose linear xdp_frame header,\nheadroom, and packet data exceed PAGE_SIZE. A source frame backed by a\nlarger allocation can still satisfy that check while extending into the\nclone\u0027s required shared-info area. When such a clone is converted back\ninto an skb, build_skb_around() places skb_shared_info over live packet\nbytes and later writes can corrupt XDP return metadata.\n\nReject clones unless their linear area fits inside\nSKB_WITH_OVERHEAD(PAGE_SIZE), matching the tailroom requirement already\nenforced by the XDP-to-skb conversion path."
    }
  ],
  "id": "CVE-2026-74616",
  "lastModified": "2026-08-22T16:16:34.280",
  "metrics": {},
  "published": "2026-08-22T16:16:34.280",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/58408982fa39f9758124cec169f42854d6f98f35"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/685edea27ac68d08fe4dbd3de74b858d2ad8e830"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/ba13763d667e008e185fedf592d53846a5b457d1"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/e48e8edbef2eb824201495daa5234560f632b23c"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/ef4b7c7046d29a67090de15af0da0d1ae8d1b192"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/f463b6f4957c9c3fd1c75f8d3e5af4879fa609c0"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/fab820f1691a9e26d9031f18aae1e9ce09078f92"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

GHSA-X7HH-PF5F-27MW

Vulnerability from github – Published: 2026-08-22 18:30 – Updated: 2026-08-22 18:30

Details

In the Linux kernel, the following vulnerability has been resolved:

xdp: reject clones that overrun skb_shared_info tailroom

xdpf_clone() clones broadcast copies into a single page and sets frame_sz to PAGE_SIZE. __xdp_build_skb_from_frame() later treats that page like a normal XDP frame and expects the usual skb_shared_info tailroom at the end of the buffer.

The current check only rejects frames whose linear xdp_frame header, headroom, and packet data exceed PAGE_SIZE. A source frame backed by a larger allocation can still satisfy that check while extending into the clone's required shared-info area. When such a clone is converted back into an skb, build_skb_around() places skb_shared_info over live packet bytes and later writes can corrupt XDP return metadata.

Reject clones unless their linear area fits inside SKB_WITH_OVERHEAD(PAGE_SIZE), matching the tailroom requirement already enforced by the XDP-to-skb conversion path.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-74616"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-22T16:16:34Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nxdp: reject clones that overrun skb_shared_info tailroom\n\nxdpf_clone() clones broadcast copies into a single page and sets\nframe_sz to PAGE_SIZE. __xdp_build_skb_from_frame() later treats that\npage like a normal XDP frame and expects the usual skb_shared_info\ntailroom at the end of the buffer.\n\nThe current check only rejects frames whose linear xdp_frame header,\nheadroom, and packet data exceed PAGE_SIZE. A source frame backed by a\nlarger allocation can still satisfy that check while extending into the\nclone\u0027s required shared-info area. When such a clone is converted back\ninto an skb, build_skb_around() places skb_shared_info over live packet\nbytes and later writes can corrupt XDP return metadata.\n\nReject clones unless their linear area fits inside\nSKB_WITH_OVERHEAD(PAGE_SIZE), matching the tailroom requirement already\nenforced by the XDP-to-skb conversion path.",
  "id": "GHSA-x7hh-pf5f-27mw",
  "modified": "2026-08-22T18:30:27Z",
  "published": "2026-08-22T18:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74616"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/58408982fa39f9758124cec169f42854d6f98f35"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/685edea27ac68d08fe4dbd3de74b858d2ad8e830"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ba13763d667e008e185fedf592d53846a5b457d1"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e48e8edbef2eb824201495daa5234560f632b23c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ef4b7c7046d29a67090de15af0da0d1ae8d1b192"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f463b6f4957c9c3fd1c75f8d3e5af4879fa609c0"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/fab820f1691a9e26d9031f18aae1e9ce09078f92"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

MSRC_CVE-2026-74616

Vulnerability from csaf_microsoft - Published: 2026-08-24 01:03 - Updated: 2026-08-24 01:03

Summary

xdp: reject clones that overrun skb_shared_info tailroom

Notes

Additional Resources: To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

Disclaimer: The information provided in the Microsoft Knowledge Base is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

CVE-2026-74616

Affected products

Under investigation 1 product

Product	Identifier	Version	Remediation
Unresolved product id: 17084-1		—

References

4 references

URL	Category
https://msrc.microsoft.com/csaf/vex/2026/msrc_cve…	self
https://support.microsoft.com/lifecycle	external
https://www.first.org/cvss	external
https://msrc.microsoft.com/csaf/vex/2026/msrc_cve…	self

JSON

To clipboard

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2026-74616 xdp: reject clones that overrun skb_shared_info tailroom - VEX",
        "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74616.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "xdp: reject clones that overrun skb_shared_info tailroom",
    "tracking": {
      "current_release_date": "2026-08-24T01:03:41.000Z",
      "generator": {
        "date": "2026-08-24T07:05:02.585Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2026-74616",
      "initial_release_date": "2026-08-24T01:03:41.000Z",
      "revision_history": [
        {
          "date": "2026-08-24T01:03:41.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "3.0",
                "product": {
                  "name": "Azure Linux 3.0",
                  "product_id": "17084"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          },
          {
            "category": "product_name",
            "name": "azl3 kernel 0:6.6.150.1-1.azl3",
            "product": {
              "name": "azl3 kernel 0:6.6.150.1-1.azl3",
              "product_id": "1"
            }
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 kernel 0:6.6.150.1-1.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-1"
        },
        "product_reference": "1",
        "relates_to_product_reference": "17084"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-74616",
      "notes": [
        {
          "category": "general",
          "text": "Linux",
          "title": "Assigning CNA"
        }
      ],
      "product_status": {
        "under_investigation": [
          "17084-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-74616 xdp: reject clones that overrun skb_shared_info tailroom - VEX",
          "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74616.json"
        }
      ],
      "title": "xdp: reject clones that overrun skb_shared_info tailroom"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-74616 (GCVE-0-2026-74616)

FKIE_CVE-2026-74616

GHSA-X7HH-PF5F-27MW

MSRC_CVE-2026-74616

Tags

Sightings

Nomenclature