CVE-2026-81002: xdp: fix zero-copy frame layout
In the Linux kernel, the following vulnerability has been resolved:
xdp: fix zero-copy frame layout
xdpconvertzctoxdpframe() clones an XSK packet into an order-0 page and advertises PAGESIZE as its frame size. It allows the copied frame to occupy the page tail needed by skbsharedinfo and records zero headroom even when metadata separates the frame header from packet data. An AFXDP zero-copy packet redirected through cpumap can therefore make the skb overlap skbsharedinfo or place it beyond the allocated page.
Limit the copied layout to SKBWITHOVERHEAD(PAGESIZE) and include the metadata length in frame headroom. Redirect callers already handle a NULL conversion result.
BUG: KASAN: slab-out-of-bounds in skbgroreceive Write of size 4 at addr ffff88800cf37004 by task cpumap/1/map:1/146 Call Trace: skbgroreceive (net/core/gro.c:174) udpgroreceive (net/ipv4/udpoffload.c:812) inetgroreceive (net/ipv4/afinet.c:1539) devgroreceive (net/core/gro.c:515) groreceiveskb (net/core/gro.c:633) cpumapkthreadrun (kernel/bpf/cpumap.c:395) kthread (kernel/kthread.c:436) retfromfork (arch/x86/kernel/process.c:164) retfromforkasm (arch/x86/entry/entry64.S:255) Kernel panic - not syncing: KASAN: paniconwarn set ...
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The affected path requires AF_XDP zero-copy packets to be redirected through cpumap. Systems not using that combination are not described as reaching the vulnerable conversion path.
What conditions trigger the memory-safety failure?
A zero-copy AF_XDP packet is converted into an XDP frame during cpumap redirection. The incorrect advertised frame size and missing metadata headroom can cause the resulting skb to overlap skb_shared_info or extend beyond the allocated page.
How might the issue appear at runtime?
The reported failure is a KASAN slab-out-of-bounds write in skb_gro_receive, reached from UDP GRO processing in a cpumap kernel thread. The provided data does not describe other detection methods or observable symptoms.