CVE-2026-64355: bpf: Reject fragmented frames in devmap
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject fragmented frames in devmap
Devmap broadcast redirects clone the packet for all but the last destination.
For native XDP, that clone path copies only the linear xdpframe data, while fragmented frames keep skbsharedinfo in tailroom outside the linear area. Cloning such a frame leaves XDPFLAGSHASFRAGS set but without valid frag metadata, and the later free path can interpret uninitialized tail data as skbsharedinfo, leading to an out-of-bounds access during frame return.
Reject fragmented native XDP frames in devmapenqueueclone().
Add the same restriction to the generic XDP clone path in devmapredirectclone(). Generic XDP represents fragmented packets as nonlinear skbs, and rejecting them here keeps clone-based broadcast support aligned between native and generic XDP.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64355?
CVE-2026-64355 has a critical severity rating of 9.8 according to the CVSS 3.1 score.
What impact does CVE-2026-64355 have on affected systems?
CVE-2026-64355 can lead to potential data integrity issues as it allows for fragmented network frames to be processed incorrectly.
How do I fix CVE-2026-64355?
To fix CVE-2026-64355, users should update their Linux kernel to the latest version where the vulnerability has been addressed.
Which versions of the Linux kernel are affected by CVE-2026-64355?
CVE-2026-64355 affects all versions of the Linux kernel prior to the patched updates provided after the vulnerability was reported.
What does CVE-2026-64355 mean for network security?
CVE-2026-64355 poses a significant risk to network security as it can allow attackers to manipulate packet handling via fragmented frames.