CVE-2026-81002

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xdp: fix zero-copy frame layout

xdp_convert_zc_to_xdp_frame() clones an XSK packet into an order-0 page

and advertises PAGE_SIZE as its frame size. It allows the copied frame

to occupy the page tail needed by skb_shared_info and records zero

headroom even when metadata separates the frame header from packet data.

An AF_XDP zero-copy packet redirected through cpumap can therefore make

the skb overlap skb_shared_info or place it beyond the allocated page.

Limit the copied layout to SKB_WITH_OVERHEAD(PAGE_SIZE) and include the

metadata length in frame headroom. Redirect callers already handle a

NULL conversion result.

BUG: KASAN: slab-out-of-bounds in skb_gro_receive

Write of size 4 at addr ffff88800cf37004 by task cpumap/1/map:1/146

Call Trace:

skb_gro_receive (net/core/gro.c:174)

udp_gro_receive (net/ipv4/udp_offload.c:812)

inet_gro_receive (net/ipv4/af_inet.c:1539)

dev_gro_receive (net/core/gro.c:515)

gro_re

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References