CVE-2026-81002

A critical (CVSS 9.8) memory-corruption flaw exists in the Linux kernel's XDP subsystem: xdp_convert_zc_to_xdp_frame() clones AF_XDP zero-copy packets into an order-0 page while incorrectly advertising PAGE_SIZE as the frame size and recording zero headroom, so the resulting skb can overlap or run past the skb_shared_info area reserved at the page tail. When such a packet is redirected through a BPF cpumap, subsequent GRO processing (skb_gro_receive) performs out-of-bounds writes, as confirmed by a KASAN slab-out-of-bounds report and resulting kernel panic. A remote attacker who can deliver traffic to a host running an XDP program that combines zero-copy AF_XDP sockets with a cpumap redirect can corrupt kernel memory, causing denial of service via kernel panic and plausibly arbitrary code execution in kernel context. In practice this configuration is used mainly in high-performance packet-processing stacks (e.g., XDP-based load balancers, traffic filters, DDoS scrubbing), not on typical desktop or server deployments. No public proof-of-concept exists, the issue is not in CISA's KEV, and no exploitation in the wild has been reported; the fix limits the copied layout to SKB_WITH_OVERHEAD(PAGE_SIZE) and accounts for metadata length in frame headroom.

What to do: Apply your distribution's latest stable kernel updates containing the upstream fix, which clamps the copied frame to SKB_WITH_OVERHEAD(PAGE_SIZE) and includes metadata length in headroom; confirm the patched version with your distro, as specific fixed version numbers were not listed in this advisory. If immediate patching is not possible, reconfigure XDP programs to avoid redirecting zero-copy AF_XDP frames through cpumap (e.g., use copy mode or an alternate redirect target). Watch for KASAN splats or panics originating from cpu_map_kthread_run/skb_gro_receive as evidence of trigger attempts.