CVE-2026-53216

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-53216", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-06-09T07:44:35.392Z", "datePublished": "2026-06-25T08:39:19.529Z", "dateUpdated": "2026-08-05T12:34:12.526Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:34:12.526Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mvpp2: limit XDP frame size to the RX buffer\n\nmvpp2 has short and long BM pools, and short pool buffers can be smaller\nthan PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with\nPAGE_SIZE as frame size.\n\nXDP helpers use frame_sz to validate tail growth and to derive the hard\nend of the data area. Advertising PAGE_SIZE for short buffers can let\nbpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting\nmemory or later tripping skb tailroom checks.\n\nInitialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches\nthe actual buffer backing the packet."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable mvpp2 RX/XDP path is reached by packets arriving on a network interface, and in a plausible XDP-enabled router/firewall deployment a remote peer can trigger it with crafted traffic.\nAC:L - There is no race; once XDP tail growth is present, packet size and repeated delivery are attacker-controllable and the short-buffer condition is deterministic.\nPR:N - In the highest reasonable deployment, the XDP program is already part of the exposed dataplane, so the packet sender needs no local account or authentication. Administrative privilege is needed to install XDP, but not to trigger the vulnerable receive path.\nUI:N - No victim user action is required after the affected interface and XDP dataplane are running.\nS:U - The corruption occurs within the kernel/network-driver security authority and does not cross a separate boundary such as guest-to-host or IOMMU isolation.\nC:H - This is kernel memory corruption from writing past the real RX buffer; such corruption can reasonably be leveraged for information disclosure.\nI:H - bpf_xdp_adjust_tail() can write beyond the allocated buffer due to the false PAGE_SIZE frame limit, making this an out-of-bounds kernel write.\nA:H - The bug can corrupt adjacent memory or trip skb tailroom checks, making kernel crashes or persistent receive-path failure plausible."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c"], "versions": [{"version": "07dd0a7aae7f72af7cec18909581c2bb570edddc", "lessThan": "a3ee9231ccec6ec3be2de89c56f897055fd9eab1", "status": "affected", "versionType": "git"}, {"version": "07dd0a7aae7f72af7cec18909581c2bb570edddc", "lessThan": "ec8e1e5842bc0dbd4c272761f4db3651eecd0339", "status": "affected", "versionType": "git"}, {"version": "07dd0a7aae7f72af7cec18909581c2bb570edddc", "lessThan": "3b8b0c3631b19faee53f0d15a49924129b063eec", "status": "affected", "versionType": "git"}, {"version": "07dd0a7aae7f72af7cec18909581c2bb570edddc", "lessThan": "994bd2b58d2bd08aa97ec0836cc813cfcb00d749", "status": "affected", "versionType": "git"}, {"version": "07dd0a7aae7f72af7cec18909581c2bb570edddc", "lessThan": "910617a4e67dbdd5fdb39d9dc6a51e491e1b2c3e", "status": "affected", "versionType": "git"}, {"version": "07dd0a7aae7f72af7cec18909581c2bb570edddc", "lessThan": "9545cc5ef18ca22d031f2f47c157192460652359", "status": "affected", "versionType": "git"}, {"version": "07dd0a7aae7f72af7cec18909581c2bb570edddc", "lessThan": "f3c6aa078927e6fe8121c9c591ddee8716c5305a", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c"], "versions": [{"version": "5.9", "status": "affected"}, {"version": "0", "lessThan": "5.9", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.210", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.176", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.143", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.94", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.36", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.13", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "5.15.210"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "6.1.176"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "6.6.143"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "6.12.94"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "6.18.36"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "7.0.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a3ee9231ccec6ec3be2de89c56f897055fd9eab1"}, {"url": "https://git.kernel.org/stable/c/ec8e1e5842bc0dbd4c272761f4db3651eecd0339"}, {"url": "https://git.kernel.org/stable/c/3b8b0c3631b19faee53f0d15a49924129b063eec"}, {"url": "https://git.kernel.org/stable/c/994bd2b58d2bd08aa97ec0836cc813cfcb00d749"}, {"url": "https://git.kernel.org/stable/c/910617a4e67dbdd5fdb39d9dc6a51e491e1b2c3e"}, {"url": "https://git.kernel.org/stable/c/9545cc5ef18ca22d031f2f47c157192460652359"}, {"url": "https://git.kernel.org/stable/c/f3c6aa078927e6fe8121c9c591ddee8716c5305a"}], "title": "net: mvpp2: limit XDP frame size to the RX buffer", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a3ee9231ccec6ec3be2de89c56f897055fd9eab1", "status": "affected", "version": "07dd0a7aae7f72af7cec18909581c2bb570edddc", "versionType": "git"}, {"lessThan": "ec8e1e5842bc0dbd4c272761f4db3651eecd0339", "status": "affected", "version": "07dd0a7aae7f72af7cec18909581c2bb570edddc", "versionType": "git"}, {"lessThan": "3b8b0c3631b19faee53f0d15a49924129b063eec", "status": "affected", "version": "07dd0a7aae7f72af7cec18909581c2bb570edddc", "versionType": "git"}, {"lessThan": "994bd2b58d2bd08aa97ec0836cc813cfcb00d749", "status": "affected", "version": "07dd0a7aae7f72af7cec18909581c2bb570edddc", "versionType": "git"}, {"lessThan": "910617a4e67dbdd5fdb39d9dc6a51e491e1b2c3e", "status": "affected", "version": "07dd0a7aae7f72af7cec18909581c2bb570edddc", "versionType": "git"}, {"lessThan": "9545cc5ef18ca22d031f2f47c157192460652359", "status": "affected", "version": "07dd0a7aae7f72af7cec18909581c2bb570edddc", "versionType": "git"}, {"lessThan": "f3c6aa078927e6fe8121c9c591ddee8716c5305a", "status": "affected", "version": "07dd0a7aae7f72af7cec18909581c2bb570edddc", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.9"}, {"lessThan": "5.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.210", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.176", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.143", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.94", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.36", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "82FCD9A0-A2BA-4D6D-B100-F059249AC188", "versionEndExcluding": "5.15.210", "versionStartIncluding": "5.9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C4446623-5F2B-4DD8-8666-9FAAC285A757", "versionEndExcluding": "6.1.176", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9062F1CD-CAD6-4EA2-A73F-C06D4A887B8C", "versionEndExcluding": "6.6.143", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "85421C0C-ABDE-4357-971C-67F9087DE1B9", "versionEndExcluding": "6.12.94", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "389025D2-958D-41BD-BD96-70ED1033A9F3", "versionEndExcluding": "6.18.36", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6A64BF9F-3BCA-42FD-98CB-8F03474D2B1E", "versionEndExcluding": "7.0.13", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*", "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*", "matchCriteriaId": "81DFF19E-9CF8-49C6-8C36-1E4038622933", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:*", "matchCriteriaId": "B0E8FC71-3952-444C-83E9-718DBBBEC615", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc7:*:*:*:*:*:*", "matchCriteriaId": "1039E95A-8CC3-4C88-8FF9-5C08EEB861C9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mvpp2: limit XDP frame size to the RX buffer\n\nmvpp2 has short and long BM pools, and short pool buffers can be smaller\nthan PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with\nPAGE_SIZE as frame size.\n\nXDP helpers use frame_sz to validate tail growth and to derive the hard\nend of the data area. Advertising PAGE_SIZE for short buffers can let\nbpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting\nmemory or later tripping skb tailroom checks.\n\nInitialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches\nthe actual buffer backing the packet."}], "id": "CVE-2026-53216", "lastModified": "2026-07-02T20:52:36.960", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-06-25T09:16:39.280", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3b8b0c3631b19faee53f0d15a49924129b063eec"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/910617a4e67dbdd5fdb39d9dc6a51e491e1b2c3e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9545cc5ef18ca22d031f2f47c157192460652359"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/994bd2b58d2bd08aa97ec0836cc813cfcb00d749"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a3ee9231ccec6ec3be2de89c56f897055fd9eab1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ec8e1e5842bc0dbd4c272761f4db3651eecd0339"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f3c6aa078927e6fe8121c9c591ddee8716c5305a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: net: mvpp2: limit XDP frame size to the RX buffer", "id": "2492814", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492814"}, "csaw": false, "cwe": "CWE-787", "details": ["A flaw was found in the Linux kernel's mvpp2 network driver. This vulnerability arises from improper handling of the eXpress Data Path (XDP) frame size, where the system advertises a larger frame size than the actual allocated buffer for short buffer pools. This can allow the bpf_xdp_adjust_tail() function to write data beyond the intended memory boundary, leading to memory corruption. Such corruption could potentially result in system instability or denial of service."], "name": "CVE-2026-53216", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-06-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-53216\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-53216\nhttps://lore.kernel.org/linux-cve-announce/2026062504-CVE-2026-53216-9219@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[07dd0a7aae7f72af7cec18909581c2bb570edddc,a3ee9231ccec6ec3be2de89c56f897055fd9eab1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[07dd0a7aae7f72af7cec18909581c2bb570edddc,ec8e1e5842bc0dbd4c272761f4db3651eecd0339)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[07dd0a7aae7f72af7cec18909581c2bb570edddc,3b8b0c3631b19faee53f0d15a49924129b063eec)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[07dd0a7aae7f72af7cec18909581c2bb570edddc,994bd2b58d2bd08aa97ec0836cc813cfcb00d749)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[07dd0a7aae7f72af7cec18909581c2bb570edddc,910617a4e67dbdd5fdb39d9dc6a51e491e1b2c3e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[07dd0a7aae7f72af7cec18995c2bb570edddc,9545cc5ef18ca22d031f2f47c157192460652359)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[07dd0a7aae7f72af7cec18909581c2bb570edddc,f3c6aa078927e6fe8121c9c591ddee8716c5305a)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.9"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.9)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.210,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.176,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.143,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.94,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.36,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.13,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-06-25T12:00:14.023430+00:00", "updated": "2026-08-12T08:30:16.959153+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}