CVE-2026-23140

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23140", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.972Z", "datePublished": "2026-02-14T15:22:24.727Z", "dateUpdated": "2026-11-05T21:23:19.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:00:54.453Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, test_run: Subtract size of xdp_frame from allowed metadata size\n\nThe xdp_frame structure takes up part of the XDP frame headroom,\nlimiting the size of the metadata. However, in bpf_test_run, we don't\ntake this into account, which makes it possible for userspace to supply\na metadata size that is too large (taking up the entire headroom).\n\nIf userspace supplies such a large metadata size in live packet mode,\nthe xdp_update_frame_from_buff() call in xdp_test_run_init_page() call\nwill fail, after which packet transmission proceeds with an\nuninitialised frame structure, leading to the usual Bad Stuff.\n\nThe commit in the Fixes tag fixed a related bug where the second check\nin xdp_update_frame_from_buff() could fail, but did not add any\nadditional constraints on the metadata size. Complete the fix by adding\nan additional check on the metadata size. Reorder the checks slightly to\nmake the logic clearer and add a comment."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bpf/test_run.c"], "versions": [{"version": "b6f1f780b3932ae497ed85e79bc8a1e513883624", "lessThan": "e7440935063949d6f2c10f7328d960d0ff4bce90", "status": "affected", "versionType": "git"}, {"version": "b6f1f780b3932ae497ed85e79bc8a1e513883624", "lessThan": "7c81ad5e580bd8441f8a521a8d34824ce6582ae5", "status": "affected", "versionType": "git"}, {"version": "b6f1f780b3932ae497ed85e79bc8a1e513883624", "lessThan": "6447e697cfa8a43a8e491cb81bcc390d0f28f8ba", "status": "affected", "versionType": "git"}, {"version": "b6f1f780b3932ae497ed85e79bc8a1e513883624", "lessThan": "31e37f44b60679d90b9f999c91371b15291be8e0", "status": "affected", "versionType": "git"}, {"version": "b6f1f780b3932ae497ed85e79bc8a1e513883624", "lessThan": "e558cca217790286e799a8baacd1610bda31b261", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bpf/test_run.c"], "versions": [{"version": "5.18", "status": "affected"}, {"version": "0", "lessThan": "5.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.161", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.121", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.66", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.6", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.1.161"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.6.121"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.12.66"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.18.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.19"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e7440935063949d6f2c10f7328d960d0ff4bce90"}, {"url": "https://git.kernel.org/stable/c/7c81ad5e580bd8441f8a521a8d34824ce6582ae5"}, {"url": "https://git.kernel.org/stable/c/6447e697cfa8a43a8e491cb81bcc390d0f28f8ba"}, {"url": "https://git.kernel.org/stable/c/31e37f44b60679d90b9f999c91371b15291be8e0"}, {"url": "https://git.kernel.org/stable/c/e558cca217790286e799a8baacd1610bda31b261"}], "title": "bpf, test_run: Subtract size of xdp_frame from allowed metadata size", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23140", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:20:32.068498Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:23:19.000Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23140", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:20:32.068498Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:20:33.205Z"}}], "cna": {"title": "bpf, test_run: Subtract size of xdp_frame from allowed metadata size", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "b6f1f780b3932ae497ed85e79bc8a1e513883624", "lessThan": "e7440935063949d6f2c10f7328d960d0ff4bce90", "versionType": "git"}, {"status": "affected", "version": "b6f1f780b3932ae497ed85e79bc8a1e513883624", "lessThan": "7c81ad5e580bd8441f8a521a8d34824ce6582ae5", "versionType": "git"}, {"status": "affected", "version": "b6f1f780b3932ae497ed85e79bc8a1e513883624", "lessThan": "6447e697cfa8a43a8e491cb81bcc390d0f28f8ba", "versionType": "git"}, {"status": "affected", "version": "b6f1f780b3932ae497ed85e79bc8a1e513883624", "lessThan": "31e37f44b60679d90b9f999c91371b15291be8e0", "versionType": "git"}, {"status": "affected", "version": "b6f1f780b3932ae497ed85e79bc8a1e513883624", "lessThan": "e558cca217790286e799a8baacd1610bda31b261", "versionType": "git"}], "programFiles": ["net/bpf/test_run.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.18"}, {"status": "unaffected", "version": "0", "lessThan": "5.18", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.161", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.121", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.66", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.6", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/bpf/test_run.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/e7440935063949d6f2c10f7328d960d0ff4bce90"}, {"url": "https://git.kernel.org/stable/c/7c81ad5e580bd8441f8a521a8d34824ce6582ae5"}, {"url": "https://git.kernel.org/stable/c/6447e697cfa8a43a8e491cb81bcc390d0f28f8ba"}, {"url": "https://git.kernel.org/stable/c/31e37f44b60679d90b9f999c91371b15291be8e0"}, {"url": "https://git.kernel.org/stable/c/e558cca217790286e799a8baacd1610bda31b261"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, test_run: Subtract size of xdp_frame from allowed metadata size\n\nThe xdp_frame structure takes up part of the XDP frame headroom,\nlimiting the size of the metadata. However, in bpf_test_run, we don't\ntake this into account, which makes it possible for userspace to supply\na metadata size that is too large (taking up the entire headroom).\n\nIf userspace supplies such a large metadata size in live packet mode,\nthe xdp_update_frame_from_buff() call in xdp_test_run_init_page() call\nwill fail, after which packet transmission proceeds with an\nuninitialised frame structure, leading to the usual Bad Stuff.\n\nThe commit in the Fixes tag fixed a related bug where the second check\nin xdp_update_frame_from_buff() could fail, but did not add any\nadditional constraints on the metadata size. Complete the fix by adding\nan additional check on the metadata size. Reorder the checks slightly to\nmake the logic clearer and add a comment."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.161", "versionStartIncluding": "5.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.121", "versionStartIncluding": "5.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.66", "versionStartIncluding": "5.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.6", "versionStartIncluding": "5.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19", "versionStartIncluding": "5.18"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:00:54.453Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23140", "state": "PUBLISHED", "dateUpdated": "2026-11-05T21:23:19.000Z", "dateReserved": "2026-01-13T15:37:45.972Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-02-14T15:22:24.727Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/bpf/test_run.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e7440935063949d6f2c10f7328d960d0ff4bce90", "status": "affected", "version": "b6f1f780b3932ae497ed85e79bc8a1e513883624", "versionType": "git"}, {"lessThan": "7c81ad5e580bd8441f8a521a8d34824ce6582ae5", "status": "affected", "version": "b6f1f780b3932ae497ed85e79bc8a1e513883624", "versionType": "git"}, {"lessThan": "6447e697cfa8a43a8e491cb81bcc390d0f28f8ba", "status": "affected", "version": "b6f1f780b3932ae497ed85e79bc8a1e513883624", "versionType": "git"}, {"lessThan": "31e37f44b60679d90b9f999c91371b15291be8e0", "status": "affected", "version": "b6f1f780b3932ae497ed85e79bc8a1e513883624", "versionType": "git"}, {"lessThan": "e558cca217790286e799a8baacd1610bda31b261", "status": "affected", "version": "b6f1f780b3932ae497ed85e79bc8a1e513883624", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/bpf/test_run.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.18"}, {"lessThan": "5.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.161", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.121", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.66", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D8396A00-9DF6-4F41-B27A-476CA41851D0", "versionEndExcluding": "6.1.161", "versionStartIncluding": "5.18", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BB7A164B-7422-4A1C-82FB-5FCAEE53C06C", "versionEndExcluding": "6.6.121", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F72B884C-B44F-40E4-9895-CE421AC663D0", "versionEndExcluding": "6.12.66", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "879529BC-5B4C-4EBE-BF1D-1A31404A8B2E", "versionEndExcluding": "6.18.6", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*", "matchCriteriaId": "17B67AA7-40D6-4AFA-8459-F200F3D7CFD1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*", "matchCriteriaId": "C47E4CC9-C826-4FA9-B014-7FE3D9B318B2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*", "matchCriteriaId": "F71D92C0-C023-48BD-B3B6-70B638EEE298", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*", "matchCriteriaId": "13580667-0A98-40CC-B29F-D12790B91BDB", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*", "matchCriteriaId": "CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, test_run: Subtract size of xdp_frame from allowed metadata size\n\nThe xdp_frame structure takes up part of the XDP frame headroom,\nlimiting the size of the metadata. However, in bpf_test_run, we don't\ntake this into account, which makes it possible for userspace to supply\na metadata size that is too large (taking up the entire headroom).\n\nIf userspace supplies such a large metadata size in live packet mode,\nthe xdp_update_frame_from_buff() call in xdp_test_run_init_page() call\nwill fail, after which packet transmission proceeds with an\nuninitialised frame structure, leading to the usual Bad Stuff.\n\nThe commit in the Fixes tag fixed a related bug where the second check\nin xdp_update_frame_from_buff() could fail, but did not add any\nadditional constraints on the metadata size. Complete the fix by adding\nan additional check on the metadata size. Reorder the checks slightly to\nmake the logic clearer and add a comment."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nbpf, test_run: Restar el tama\u00f1o de xdp_frame del tama\u00f1o de metadatos permitido\n\nLa estructura xdp_frame ocupa parte del headroom del frame XDP, limitando el tama\u00f1o de los metadatos. Sin embargo, en bpf_test_run, no tenemos esto en cuenta, lo que hace posible que el userspace suministre un tama\u00f1o de metadatos que es demasiado grande (ocupando todo el headroom).\n\nSi el userspace suministra un tama\u00f1o de metadatos tan grande en modo de paquete en vivo, la llamada a xdp_update_frame_from_buff() en la llamada a xdp_test_run_init_page() fallar\u00e1, despu\u00e9s de lo cual la transmisi\u00f3n de paquetes procede con una estructura de frame no inicializada, lo que lleva a las 'Cosas Malas' habituales.\n\nEl commit en la etiqueta Fixes corrigi\u00f3 un error relacionado donde la segunda comprobaci\u00f3n en xdp_update_frame_from_buff() podr\u00eda fallar, pero no a\u00f1adi\u00f3 ninguna restricci\u00f3n adicional sobre el tama\u00f1o de los metadatos. Completar la correcci\u00f3n a\u00f1adiendo una comprobaci\u00f3n adicional sobre el tama\u00f1o de los metadatos. Reordenar ligeramente las comprobaciones para hacer la l\u00f3gica m\u00e1s clara y a\u00f1adir un comentario."}], "id": "CVE-2026-23140", "lastModified": "2026-11-05T22:18:03.930", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23140", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T21:20:32.068498Z", "version": "2.0.3"}}]}, "published": "2026-02-14T16:15:54.060", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/31e37f44b60679d90b9f999c91371b15291be8e0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6447e697cfa8a43a8e491cb81bcc390d0f28f8ba"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7c81ad5e580bd8441f8a521a8d34824ce6582ae5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e558cca217790286e799a8baacd1610bda31b261"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e7440935063949d6f2c10f7328d960d0ff4bce90"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: bpf, test_run: Subtract size of xdp_frame from allowed metadata size", "id": "2439854", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439854"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2026-23140", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-02-14T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23140\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23140\nhttps://lore.kernel.org/linux-cve-announce/2026021430-CVE-2026-23140-fed3@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b6f1f780b3932ae497ed85e79bc8a1e513883624,e7440935063949d6f2c10f7328d960d0ff4bce90)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b6f1f780b3932ae497ed85e79bc8a1e513883624,7c81ad5e580bd8441f8a521a8d34824ce6582ae5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b6f1f780b3932ae497ed85e79bc8a1e513883624,6447e697cfa8a43a8e491cb81bcc390d0f28f8ba)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b6f1f780b3932ae497ed85e79bc8a1e513883624,31e37f44b60679d90b9f999c91371b15291be8e0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b6f1f780b3932ae497ed85e79bc8a1e513883624,e558cca217790286e799a8baacd1610bda31b261)"}}], "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.161,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.121,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.66,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.6,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.19,*]"}}], "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-17T19:38:15.948061+00:00", "value": {"mitigation_remediation": ["Upgrade the system to a kernel version that includes the patch (e.g., Linux kernel 6.19.1 or later).", "Reboot the host to load the updated kernel and activate the fix.", "If BPF test_run programs cannot be removed immediately, disable them by unloading any XDP programs that rely on this interface or by configuring the system to prevent new BPF test_run loaders."], "summary": {"action": "Apply Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "Any system running the Linux kernel with the bpf_test_run functionality is affected. The known affected CPE identifiers cover all Linux kernel releases, including all stable releases and release candidates up to 6.19 rc5. Systems using a kernel version prior to the applied patch remain vulnerable regardless of distribution.", "description_and_impact": "The vulnerability stems from the BPF test_run interface in the Linux kernel\u2019s XDP code. A userspace BPF program may specify a metadata size larger than the available headroom, not accounting for the xdp_frame structure. Consequently the kernel creates an uninitialized frame that is later used for packet transmission, leading to undefined behavior that typically manifests as a kernel crash or erratic operation, effectively denying service to the affected system.", "risk_and_exploitability": "The CVSS base score of 5.5 indicates a moderate severity, while an EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the KEV catalog. Exploitation requires a user or process capable of loading BPF programs, and an attacker could trigger a denial\u2011of\u2011service by submitting a malformed BPF test_run configuration."}}}}, "created": "2026-02-16T12:01:26.815331+00:00", "updated": "2026-04-17T19:45:25.899242+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-119", "CWE-457"]}