CVE-2026-23377

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23377", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:46.006Z", "datePublished": "2026-03-25T10:27:57.338Z", "dateUpdated": "2026-11-05T21:33:44.050Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:24:02.338Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz\n\nThe only user of frag_size field in XDP RxQ info is\nbpf_xdp_frags_increase_tail(). It clearly expects whole buff size instead\nof DMA write size. Different assumptions in ice driver configuration lead\nto negative tailroom.\n\nThis allows to trigger kernel panic, when using\nXDP_ADJUST_TAIL_GROW_MULTI_BUFF xskxceiver test and changing packet size to\n6912 and the requested offset to a huge value, e.g.\nXSK_UMEM__MAX_FRAME_SIZE * 100.\n\nDue to other quirks of the ZC configuration in ice, panic is not observed\nin ZC mode, but tailroom growing still fails when it should not.\n\nUse fill queue buffer truesize instead of DMA write size in XDP RxQ info.\nFix ZC mode too by using the new helper."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/intel/ice/ice_base.c"], "versions": [{"version": "2fba7dc5157b6f85dbf1b8e26e63a724db1f3d79", "lessThan": "f2b29bbe355221a65c3eccf9500e5e33e4f1cb5c", "status": "affected", "versionType": "git"}, {"version": "2fba7dc5157b6f85dbf1b8e26e63a724db1f3d79", "lessThan": "6aed180a44b1c0a3971107fa052a41b03acdb31e", "status": "affected", "versionType": "git"}, {"version": "2fba7dc5157b6f85dbf1b8e26e63a724db1f3d79", "lessThan": "2a2927e95cf1b8efb15bcb741bbd06c9bb0537b7", "status": "affected", "versionType": "git"}, {"version": "2fba7dc5157b6f85dbf1b8e26e63a724db1f3d79", "lessThan": "b0f05100e8795aadd1c0606bae9caefbda070d63", "status": "affected", "versionType": "git"}, {"version": "2fba7dc5157b6f85dbf1b8e26e63a724db1f3d79", "lessThan": "e142dc4ef0f451b7ef99d09aaa84e9389af629d7", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/intel/ice/ice_base.c"], "versions": [{"version": "6.3", "status": "affected"}, {"version": "0", "lessThan": "6.3", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.60", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.7", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.18.60"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.19.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/f2b29bbe355221a65c3eccf9500e5e33e4f1cb5c"}, {"url": "https://git.kernel.org/stable/c/6aed180a44b1c0a3971107fa052a41b03acdb31e"}, {"url": "https://git.kernel.org/stable/c/2a2927e95cf1b8efb15bcb741bbd06c9bb0537b7"}, {"url": "https://git.kernel.org/stable/c/b0f05100e8795aadd1c0606bae9caefbda070d63"}, {"url": "https://git.kernel.org/stable/c/e142dc4ef0f451b7ef99d09aaa84e9389af629d7"}], "title": "ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23377", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:29:03.158573Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:33:44.050Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23377", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:29:03.158573Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:29:04.762Z"}}], "cna": {"title": "ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2fba7dc5157b6f85dbf1b8e26e63a724db1f3d79", "lessThan": "f2b29bbe355221a65c3eccf9500e5e33e4f1cb5c", "versionType": "git"}, {"status": "affected", "version": "2fba7dc5157b6f85dbf1b8e26e63a724db1f3d79", "lessThan": "6aed180a44b1c0a3971107fa052a41b03acdb31e", "versionType": "git"}, {"status": "affected", "version": "2fba7dc5157b6f85dbf1b8e26e63a724db1f3d79", "lessThan": "2a2927e95cf1b8efb15bcb741bbd06c9bb0537b7", "versionType": "git"}, {"status": "affected", "version": "2fba7dc5157b6f85dbf1b8e26e63a724db1f3d79", "lessThan": "b0f05100e8795aadd1c0606bae9caefbda070d63", "versionType": "git"}, {"status": "affected", "version": "2fba7dc5157b6f85dbf1b8e26e63a724db1f3d79", "lessThan": "e142dc4ef0f451b7ef99d09aaa84e9389af629d7", "versionType": "git"}], "programFiles": ["drivers/net/ethernet/intel/ice/ice_base.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.3"}, {"status": "unaffected", "version": "0", "lessThan": "6.3", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.160", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.114", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.60", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.7", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/intel/ice/ice_base.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/f2b29bbe355221a65c3eccf9500e5e33e4f1cb5c"}, {"url": "https://git.kernel.org/stable/c/6aed180a44b1c0a3971107fa052a41b03acdb31e"}, {"url": "https://git.kernel.org/stable/c/2a2927e95cf1b8efb15bcb741bbd06c9bb0537b7"}, {"url": "https://git.kernel.org/stable/c/b0f05100e8795aadd1c0606bae9caefbda070d63"}, {"url": "https://git.kernel.org/stable/c/e142dc4ef0f451b7ef99d09aaa84e9389af629d7"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz\n\nThe only user of frag_size field in XDP RxQ info is\nbpf_xdp_frags_increase_tail(). It clearly expects whole buff size instead\nof DMA write size. Different assumptions in ice driver configuration lead\nto negative tailroom.\n\nThis allows to trigger kernel panic, when using\nXDP_ADJUST_TAIL_GROW_MULTI_BUFF xskxceiver test and changing packet size to\n6912 and the requested offset to a huge value, e.g.\nXSK_UMEM__MAX_FRAME_SIZE * 100.\n\nDue to other quirks of the ZC configuration in ice, panic is not observed\nin ZC mode, but tailroom growing still fails when it should not.\n\nUse fill queue buffer truesize instead of DMA write size in XDP RxQ info.\nFix ZC mode too by using the new helper."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.160", "versionStartIncluding": "6.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.114", "versionStartIncluding": "6.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.60", "versionStartIncluding": "6.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.7", "versionStartIncluding": "6.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "6.3"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:24:02.338Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23377", "state": "PUBLISHED", "dateUpdated": "2026-11-05T21:33:44.050Z", "dateReserved": "2026-01-13T15:37:46.006Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-03-25T10:27:57.338Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/intel/ice/ice_base.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "f2b29bbe355221a65c3eccf9500e5e33e4f1cb5c", "status": "affected", "version": "2fba7dc5157b6f85dbf1b8e26e63a724db1f3d79", "versionType": "git"}, {"lessThan": "6aed180a44b1c0a3971107fa052a41b03acdb31e", "status": "affected", "version": "2fba7dc5157b6f85dbf1b8e26e63a724db1f3d79", "versionType": "git"}, {"lessThan": "2a2927e95cf1b8efb15bcb741bbd06c9bb0537b7", "status": "affected", "version": "2fba7dc5157b6f85dbf1b8e26e63a724db1f3d79", "versionType": "git"}, {"lessThan": "b0f05100e8795aadd1c0606bae9caefbda070d63", "status": "affected", "version": "2fba7dc5157b6f85dbf1b8e26e63a724db1f3d79", "versionType": "git"}, {"lessThan": "e142dc4ef0f451b7ef99d09aaa84e9389af629d7", "status": "affected", "version": "2fba7dc5157b6f85dbf1b8e26e63a724db1f3d79", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/intel/ice/ice_base.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.3"}, {"lessThan": "6.3", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.60", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "773D6612-E903-45AF-AD3C-5A967BCBBB1E", "versionEndExcluding": "6.19.7", "versionStartIncluding": "6.3", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz\n\nThe only user of frag_size field in XDP RxQ info is\nbpf_xdp_frags_increase_tail(). It clearly expects whole buff size instead\nof DMA write size. Different assumptions in ice driver configuration lead\nto negative tailroom.\n\nThis allows to trigger kernel panic, when using\nXDP_ADJUST_TAIL_GROW_MULTI_BUFF xskxceiver test and changing packet size to\n6912 and the requested offset to a huge value, e.g.\nXSK_UMEM__MAX_FRAME_SIZE * 100.\n\nDue to other quirks of the ZC configuration in ice, panic is not observed\nin ZC mode, but tailroom growing still fails when it should not.\n\nUse fill queue buffer truesize instead of DMA write size in XDP RxQ info.\nFix ZC mode too by using the new helper."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nice: cambiar frag_size de XDP RxQ de la longitud de escritura DMA a xdp.frame_sz\n\nEl \u00fanico usuario del campo frag_size en la informaci\u00f3n de XDP RxQ es bpf_xdp_frags_increase_tail(). Claramente espera el tama\u00f1o completo del b\u00fafer en lugar del tama\u00f1o de escritura DMA. Diferentes suposiciones en la configuraci\u00f3n del controlador ice llevan a un tailroom negativo.\n\nEsto permite activar un p\u00e1nico del kernel, al usar la prueba xskxceiver XDP_ADJUST_TAIL_GROW_MULTI_BUFF y cambiar el tama\u00f1o del paquete a 6912 y el desplazamiento solicitado a un valor enorme, por ejemplo, XSK_UMEM__MAX_FRAME_SIZE * 100.\n\nDebido a otras peculiaridades de la configuraci\u00f3n ZC en ice, no se observa p\u00e1nico en modo ZC, pero el crecimiento del tailroom sigue fallando cuando no deber\u00eda.\n\nUsar el tama\u00f1o real del b\u00fafer de la cola de llenado en lugar del tama\u00f1o de escritura DMA en la informaci\u00f3n de XDP RxQ. Corregir el modo ZC tambi\u00e9n usando la nueva funci\u00f3n auxiliar."}], "id": "CVE-2026-23377", "lastModified": "2026-11-05T22:18:18.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23377", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T21:29:03.158573Z", "version": "2.0.3"}}]}, "published": "2026-03-25T11:16:37.520", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2a2927e95cf1b8efb15bcb741bbd06c9bb0537b7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6aed180a44b1c0a3971107fa052a41b03acdb31e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b0f05100e8795aadd1c0606bae9caefbda070d63"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e142dc4ef0f451b7ef99d09aaa84e9389af629d7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f2b29bbe355221a65c3eccf9500e5e33e4f1cb5c"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz", "id": "2451261", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451261"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-131", "details": ["A flaw was found in the Linux kernel, specifically within the `ice` network driver and the eXpress Data Path (XDP) component. This vulnerability arises from an incorrect calculation of the `frag_size` in XDP receive queue information, which can lead to an invalid memory state known as \"negative tailroom.\" A local user can exploit this by manipulating packet sizes and offsets during XDP operations. Successful exploitation can trigger a kernel panic, resulting in a Denial of Service (DoS) for the affected system."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, prevent the ice module from being loaded. See https://access.redhat.com/solutions/41278 for instructions."}, "name": "CVE-2026-23377", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-03-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23377\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23377\nhttps://lore.kernel.org/linux-cve-announce/2026032542-CVE-2026-23377-cb04@gregkh/T"], "statement": "This flaw affects systems with Intel ice network adapters using XDP (eXpress Data Path). The incorrect frag_size calculation (DMA write size vs. buffer truesize) causes bpf_xdp_frags_increase_tail() to compute negative tailroom, leading to memory corruption or kernel panic. Triggerable via XDP_ADJUST_TAIL with specific packet sizes. Requires XDP program loading privileges.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2fba7dc5157b6f85dbf1b8e26e63a724db1f3d79,b0f05100e8795aadd1c0606bae9caefbda070d63)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2fba7dc5157b6f85dbf1b8e26e63a724db1f3d79,e142dc4ef0f451b7ef99d09aaa84e9389af629d7)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.3"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.3)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.7,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T09:08:39.841163+00:00", "value": {"mitigation_remediation": ["Update the Linux kernel to include the patch that corrects frag_size handling in the ice driver.", "If a kernel upgrade cannot be performed immediately, refrain from using XDP_ADJUST_TAIL_GROW_MULTI_BUFF with packet sizes beyond 6912 bytes or with excessively large offsets.", "If XDP functionality on the ice device is not required, disable the XDP path to eliminate the attacker\u2019s attack surface.", "Monitor kernel logs for panics or related error messages and apply the vendor\u2019s latest patch as soon as it becomes available."], "summary": {"action": "Patch Kernel", "impact": "Denial of Service via Kernel Panic"}, "threat_synthesis": {"affected_systems": "This issue affects all Linux kernel releases that ship the unpatched ice network driver. The ice driver is used for Intel Ethernet controllers in the Linux kernel. No specific kernel version range is provided in the advisory, so any kernel that has not yet incorporated the change to compute frag_size correctly may be vulnerable. Vendors that distribute kernels containing the legacy ice driver need to ensure the fix is included before exposing the kernel to user\u2011programmed XDP logic.", "description_and_impact": "The vulnerability resides in the ice driver\u2019s handling of the XDP Receive Queue frag_size field. The field was incorrectly set to the DMA write length rather than the full XDP frame size, causing the helper bpf_xdp_frags_increase_tail() to compute an incorrect tailroom size. When an XDP program uses the XDP_ADJUST_TAIL_GROW_MULTI_BUFF operation with an oversized packet size and a very large offset, the driver attempts to grow the tailroom based on a negative value, triggering a kernel panic. This flaw is classified as a classic integer overflow/underflow (CWE\u2011131) and results in a system\u2011wide denial of Service. The patch replaces frag_size with the true queue buffer size and also fixes zero\u2011copy mode.", "risk_and_exploitability": "The CVSS score of 5.5 denotes medium severity. The EPSS value is under 1%, and the vulnerability is not listed in the CISA KEV catalog, indicating a relatively low probability of mass exploitation. Nonetheless, the flaw requires an attacker to induce a specially crafted XDP packet path that invokes the problematic tail\u2011growth operation. Such a scenario is feasible only on systems that allow custom XDP programs on the ice driver, so while exploitation is possible, it may be limited to targeted or privileged environments."}}}}, "created": "2026-03-25T21:31:38.826867+00:00", "updated": "2026-04-28T09:15:09.686611+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}