CVE-2026-23140: bpf, test_run: Subtract size of xdp_frame from allowed metadata size
In the Linux kernel, the following vulnerability has been resolved:
bpf, testrun: Subtract size of xdpframe from allowed metadata size
The xdpframe structure takes up part of the XDP frame headroom, limiting the size of the metadata. However, in bpftestrun, we don't take this into account, which makes it possible for userspace to supply a metadata size that is too large (taking up the entire headroom).
If userspace supplies such a large metadata size in live packet mode, the xdpupdateframefrombuff() call in xdptestruninitpage() call will fail, after which packet transmission proceeds with an uninitialised frame structure, leading to the usual Bad Stuff.
The commit in the Fixes tag fixed a related bug where the second check in xdpupdateframefrombuff() could fail, but did not add any additional constraints on the metadata size. Complete the fix by adding an additional check on the metadata size. Reorder the checks slightly to make the logic clearer and add a comment.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23140?
The severity of CVE-2026-23140 is medium with a CVSS score of 5.5.
How do I fix CVE-2026-23140?
You can fix CVE-2026-23140 by applying the available patches to the Linux kernel.
What software is affected by CVE-2026-23140?
CVE-2026-23140 affects the Linux kernel.
What is the potential impact of CVE-2026-23140?
CVE-2026-23140 could result in a denial of service due to the improper handling of metadata size.
When was CVE-2026-23140 published?
CVE-2026-23140 was published on February 14, 2026.