xdp: produce a warning when calculated tailroom is negative
In the Linux kernel, the following vulnerability has been resolved: xdp: produce a warning when calculated tailroom is negative Many ethernet drivers report xdp Rx queue frag size as being the same as DMA write size. However, the only user of this field, namely bpf_xdp_frags_increase_tail(), clearly expects a truesize. Such difference leads to unspecific memory corruption issues under certain circumstances, e.g. in ixgbevf maximum DMA write size is 3 KB, so when running xskxceiver's XDP_ADJUST_TAIL_GROW_MULTI_BUFF, 6K packet fully uses all DMA-writable space in 2 buffers. This would be fine, if only rxq->frag_size was properly set to 4K, but value of 3K results in a negative tailroom, because there is a non-zero page offset. We are supposed to return -EINVAL and be done with it in such case, but due to tailroom being stored as an unsigned int, it is reported to be somewhere near UINT_MAX, resulting in a tail being grown, even if the requested offset is too much (it is around 2K in the abovementioned test). This later leads to all kinds of unspecific calltraces. [ 7340.337579] xskxceiver[1440]: segfault at 1da718 ip 00007f4161aeac9d sp 00007f41615a6a00 error 6 [ 7340.338040] xskxceiver[1441]: segfault at 7f410000000b ip 00000000004042b5 sp 00007f415bffecf0 error 4 [ 7340.338179] in libc.so.6[61c9d,7f4161aaf000+160000] [ 7340.339230] in xskxceiver[42b5,400000+69000] [ 7340.340300] likely on CPU 6 (core 0, socket 6) [ 7340.340302] Code: ff ff 01 e9 f4 fe ff ff 0f 1f 44 00 00 4c
CVE-2026-23343
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-23343
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "bf25146a5595269810b1f47d048f114c5ff9f544",
"lessThan": "01379540452a02bbc52f639d45dd365cd3624efb",
"versionType": "git"
},
{
"status": "affected",
"version": "bf25146a5595269810b1f47d048f114c5ff9f544",
"lessThan": "a0fb59f527d03c60b2cd547cfae4a842ad84670f",
"versionType": "git"
},
{
"status": "affected",
"version": "bf25146a5595269810b1f47d048f114c5ff9f544",
"lessThan": "c7c790a07697148c41e2d03eb28efe132adda749",
"versionType": "git"
},
{
"status": "affected",
"version": "bf25146a5595269810b1f47d048f114c5ff9f544",
"lessThan": "98cd8b4d0b836d3edf70161f40efd9cbb8c8f252",
"versionType": "git"
},
{
"status": "affected",
"version": "bf25146a5595269810b1f47d048f114c5ff9f544",
"lessThan": "94b9da7e9f958cb3d115b21eff824ecd8c3217aa",
"versionType": "git"
},
{
"status": "affected",
"version": "bf25146a5595269810b1f47d048f114c5ff9f544",
"lessThan": "8821e857759be9db3cde337ad328b71fe5c8a55f",
"versionType": "git"
}
],
"programFiles": [
"net/core/filter.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.18",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver",
"lessThanOrEqual": "6.19.*"
},
{
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/core/filter.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-23343
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #27230 · Revision 1
- Added to Heist Feed
- Publisher date