CVE-2026-74616: xdp: reject clones that overrun skb_shared_info tailroom
In the Linux kernel, the following vulnerability has been resolved:
xdp: reject clones that overrun skbsharedinfo tailroom
xdpfclone() clones broadcast copies into a single page and sets framesz to PAGESIZE. xdpbuildskbfromframe() later treats that page like a normal XDP frame and expects the usual skbsharedinfo tailroom at the end of the buffer.
The current check only rejects frames whose linear xdpframe header, headroom, and packet data exceed PAGESIZE. A source frame backed by a larger allocation can still satisfy that check while extending into the clone's required shared-info area. When such a clone is converted back into an skb, buildskbaround() places skbsharedinfo over live packet bytes and later writes can corrupt XDP return metadata.
Reject clones unless their linear area fits inside SKBWITHOVERHEAD(PAGESIZE), matching the tailroom requirement already enforced by the XDP-to-skb conversion path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.152.1-1
Event History
Frequently Asked Questions
What processing path is required for this issue to occur?
The affected path involves xdpf_clone() creating broadcast copies in a single page, followed by conversion of the cloned XDP frame back into an skb through __xdp_build_skb_from_frame(). The problem occurs when build_skb_around() subsequently places skb_shared_info over packet data.
Which frame layouts are relevant when triaging exposure?
A source frame backed by a larger allocation can pass the existing PAGE_SIZE linear-area check while still extending into the cloned page's required skb_shared_info tailroom. The vulnerable condition is specifically a clone whose linear area does not fit within SKB_WITH_OVERHEAD(PAGE_SIZE).
What does the fix change?
The fix rejects clones unless their linear area fits within SKB_WITH_OVERHEAD(PAGE_SIZE). This aligns clone validation with the tailroom requirement already applied during XDP-to-skb conversion.