CVE-2026-74616

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74616", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.920Z", "datePublished": "2026-08-22T15:32:01.313Z", "dateUpdated": "2026-10-16T19:06:02.219Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-25T05:40:43.432Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxdp: reject clones that overrun skb_shared_info tailroom\n\nxdpf_clone() clones broadcast copies into a single page and sets\nframe_sz to PAGE_SIZE. __xdp_build_skb_from_frame() later treats that\npage like a normal XDP frame and expects the usual skb_shared_info\ntailroom at the end of the buffer.\n\nThe current check only rejects frames whose linear xdp_frame header,\nheadroom, and packet data exceed PAGE_SIZE. A source frame backed by a\nlarger allocation can still satisfy that check while extending into the\nclone's required shared-info area. When such a clone is converted back\ninto an skb, build_skb_around() places skb_shared_info over live packet\nbytes and later writes can corrupt XDP return metadata.\n\nReject clones unless their linear area fits inside\nSKB_WITH_OVERHEAD(PAGE_SIZE), matching the tailroom requirement already\nenforced by the XDP-to-skb conversion path."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - Remote packets on an XDP ingress netdev whose program calls bpf_xdp_redirect_map() with BPF_F_BROADCAST reach xdpf_clone() through dev_map_enqueue_multi(); edge L4 load balancers and container fan-out to veth peers are common deployments where cloned frames later hit __xdp_build_skb_from_frame() without any local attacker access.\nAC:L - Once broadcast devmap redirect is deployed, an attacker can reliably craft linear frames whose headroom plus payload fall in the SKB_WITH_OVERHEAD(PAGE_SIZE)..PAGE_SIZE window; no race, timing luck, or uncontrollable memory layout is required and the condition can be retried with each packet.\nPR:N - Loading/attaching the XDP program and populating the devmap requires CAP_BPF and CAP_NET_ADMIN on the host, but an unauthenticated remote sender on the already-configured datapath needs no privileges on the victim system, matching the CNA pattern used for the related devmap broadcast clone issue CVE-2026-64355.\nUI:N - Exploitation is driven entirely by network traffic processed in NAPI/softirq after XDP redirect; no victim mount, file open, or other interactive action is required beyond packets reaching the configured interface.\nS:U - The flaw corrupts skb_shared_info placement and metadata within the host kernel address space during skb construction; it does not inherently cross VM, hypervisor, or IOMMU security boundaries.\nC:H - build_skb_around() places skb_shared_info over live packet bytes and memset initializes it there; subsequent skb/shinfo access can read kernel metadata and adjacent buffer contents beyond intended bounds, constituting exploitable out-of-bounds memory disclosure.\nI:H - Overlapping skb_shared_info tailroom lets kernel writes corrupt packet data and lets attacker-influenced bytes corrupt shinfo fields used by later stack, GRO, and transmit paths, giving an out-of-bounds write primitive over frame metadata.\nA:H - Tailroom overlap during __xdp_build_skb_from_frame() can fault or corrupt state during skb construction and downstream processing, producing kernel oops/panic; an attacker can trigger this repeatedly with crafted packets on the broadcast redirect path."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/core/xdp.c"], "versions": [{"version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266", "lessThan": "58408982fa39f9758124cec169f42854d6f98f35", "status": "affected", "versionType": "git"}, {"version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266", "lessThan": "685edea27ac68d08fe4dbd3de74b858d2ad8e830", "status": "affected", "versionType": "git"}, {"version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266", "lessThan": "ba13763d667e008e185fedf592d53846a5b457d1", "status": "affected", "versionType": "git"}, {"version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266", "lessThan": "ef4b7c7046d29a67090de15af0da0d1ae8d1b192", "status": "affected", "versionType": "git"}, {"version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266", "lessThan": "fab820f1691a9e26d9031f18aae1e9ce09078f92", "status": "affected", "versionType": "git"}, {"version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266", "lessThan": "f463b6f4957c9c3fd1c75f8d3e5af4879fa609c0", "status": "affected", "versionType": "git"}, {"version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266", "lessThan": "e48e8edbef2eb824201495daa5234560f632b23c", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/core/xdp.c"], "versions": [{"version": "5.14", "status": "affected"}, {"version": "0", "lessThan": "5.14", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.152", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.104", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.45", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "5.15.216"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.6.152"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.12.104"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.18.45"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/58408982fa39f9758124cec169f42854d6f98f35"}, {"url": "https://git.kernel.org/stable/c/685edea27ac68d08fe4dbd3de74b858d2ad8e830"}, {"url": "https://git.kernel.org/stable/c/ba13763d667e008e185fedf592d53846a5b457d1"}, {"url": "https://git.kernel.org/stable/c/ef4b7c7046d29a67090de15af0da0d1ae8d1b192"}, {"url": "https://git.kernel.org/stable/c/fab820f1691a9e26d9031f18aae1e9ce09078f92"}, {"url": "https://git.kernel.org/stable/c/f463b6f4957c9c3fd1c75f8d3e5af4879fa609c0"}, {"url": "https://git.kernel.org/stable/c/e48e8edbef2eb824201495daa5234560f632b23c"}], "title": "xdp: reject clones that overrun skb_shared_info tailroom", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74616", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:02:32.968446Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:06:02.219Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74616", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:02:32.968446Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:02:33.883Z"}}], "cna": {"title": "xdp: reject clones that overrun skb_shared_info tailroom", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - Remote packets on an XDP ingress netdev whose program calls bpf_xdp_redirect_map() with BPF_F_BROADCAST reach xdpf_clone() through dev_map_enqueue_multi(); edge L4 load balancers and container fan-out to veth peers are common deployments where cloned frames later hit __xdp_build_skb_from_frame() without any local attacker access.\nAC:L - Once broadcast devmap redirect is deployed, an attacker can reliably craft linear frames whose headroom plus payload fall in the SKB_WITH_OVERHEAD(PAGE_SIZE)..PAGE_SIZE window; no race, timing luck, or uncontrollable memory layout is required and the condition can be retried with each packet.\nPR:N - Loading/attaching the XDP program and populating the devmap requires CAP_BPF and CAP_NET_ADMIN on the host, but an unauthenticated remote sender on the already-configured datapath needs no privileges on the victim system, matching the CNA pattern used for the related devmap broadcast clone issue CVE-2026-64355.\nUI:N - Exploitation is driven entirely by network traffic processed in NAPI/softirq after XDP redirect; no victim mount, file open, or other interactive action is required beyond packets reaching the configured interface.\nS:U - The flaw corrupts skb_shared_info placement and metadata within the host kernel address space during skb construction; it does not inherently cross VM, hypervisor, or IOMMU security boundaries.\nC:H - build_skb_around() places skb_shared_info over live packet bytes and memset initializes it there; subsequent skb/shinfo access can read kernel metadata and adjacent buffer contents beyond intended bounds, constituting exploitable out-of-bounds memory disclosure.\nI:H - Overlapping skb_shared_info tailroom lets kernel writes corrupt packet data and lets attacker-influenced bytes corrupt shinfo fields used by later stack, GRO, and transmit paths, giving an out-of-bounds write primitive over frame metadata.\nA:H - Tailroom overlap during __xdp_build_skb_from_frame() can fault or corrupt state during skb construction and downstream processing, producing kernel oops/panic; an attacker can trigger this repeatedly with crafted packets on the broadcast redirect path."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266", "lessThan": "58408982fa39f9758124cec169f42854d6f98f35", "versionType": "git"}, {"status": "affected", "version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266", "lessThan": "685edea27ac68d08fe4dbd3de74b858d2ad8e830", "versionType": "git"}, {"status": "affected", "version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266", "lessThan": "ba13763d667e008e185fedf592d53846a5b457d1", "versionType": "git"}, {"status": "affected", "version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266", "lessThan": "ef4b7c7046d29a67090de15af0da0d1ae8d1b192", "versionType": "git"}, {"status": "affected", "version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266", "lessThan": "fab820f1691a9e26d9031f18aae1e9ce09078f92", "versionType": "git"}, {"status": "affected", "version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266", "lessThan": "f463b6f4957c9c3fd1c75f8d3e5af4879fa609c0", "versionType": "git"}, {"status": "affected", "version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266", "lessThan": "e48e8edbef2eb824201495daa5234560f632b23c", "versionType": "git"}], "programFiles": ["net/core/xdp.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.14"}, {"status": "unaffected", "version": "0", "lessThan": "5.14", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.216", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.183", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.152", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.104", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.45", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.9", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/core/xdp.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/58408982fa39f9758124cec169f42854d6f98f35"}, {"url": "https://git.kernel.org/stable/c/685edea27ac68d08fe4dbd3de74b858d2ad8e830"}, {"url": "https://git.kernel.org/stable/c/ba13763d667e008e185fedf592d53846a5b457d1"}, {"url": "https://git.kernel.org/stable/c/ef4b7c7046d29a67090de15af0da0d1ae8d1b192"}, {"url": "https://git.kernel.org/stable/c/fab820f1691a9e26d9031f18aae1e9ce09078f92"}, {"url": "https://git.kernel.org/stable/c/f463b6f4957c9c3fd1c75f8d3e5af4879fa609c0"}, {"url": "https://git.kernel.org/stable/c/e48e8edbef2eb824201495daa5234560f632b23c"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxdp: reject clones that overrun skb_shared_info tailroom\n\nxdpf_clone() clones broadcast copies into a single page and sets\nframe_sz to PAGE_SIZE. __xdp_build_skb_from_frame() later treats that\npage like a normal XDP frame and expects the usual skb_shared_info\ntailroom at the end of the buffer.\n\nThe current check only rejects frames whose linear xdp_frame header,\nheadroom, and packet data exceed PAGE_SIZE. A source frame backed by a\nlarger allocation can still satisfy that check while extending into the\nclone's required shared-info area. When such a clone is converted back\ninto an skb, build_skb_around() places skb_shared_info over live packet\nbytes and later writes can corrupt XDP return metadata.\n\nReject clones unless their linear area fits inside\nSKB_WITH_OVERHEAD(PAGE_SIZE), matching the tailroom requirement already\nenforced by the XDP-to-skb conversion path."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.216", "versionStartIncluding": "5.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.183", "versionStartIncluding": "5.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.152", "versionStartIncluding": "5.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.104", "versionStartIncluding": "5.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.45", "versionStartIncluding": "5.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.9", "versionStartIncluding": "5.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "5.14"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-25T05:40:43.432Z"}}}, "cveMetadata": {"cveId": "CVE-2026-74616", "state": "PUBLISHED", "dateUpdated": "2026-10-16T19:06:02.219Z", "dateReserved": "2026-08-15T05:44:03.920Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-22T15:32:01.313Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/core/xdp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "58408982fa39f9758124cec169f42854d6f98f35", "status": "affected", "version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266", "versionType": "git"}, {"lessThan": "685edea27ac68d08fe4dbd3de74b858d2ad8e830", "status": "affected", "version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266", "versionType": "git"}, {"lessThan": "ba13763d667e008e185fedf592d53846a5b457d1", "status": "affected", "version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266", "versionType": "git"}, {"lessThan": "ef4b7c7046d29a67090de15af0da0d1ae8d1b192", "status": "affected", "version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266", "versionType": "git"}, {"lessThan": "fab820f1691a9e26d9031f18aae1e9ce09078f92", "status": "affected", "version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266", "versionType": "git"}, {"lessThan": "f463b6f4957c9c3fd1c75f8d3e5af4879fa609c0", "status": "affected", "version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266", "versionType": "git"}, {"lessThan": "e48e8edbef2eb824201495daa5234560f632b23c", "status": "affected", "version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/core/xdp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.14"}, {"lessThan": "5.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.216", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.152", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.104", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.45", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxdp: reject clones that overrun skb_shared_info tailroom\n\nxdpf_clone() clones broadcast copies into a single page and sets\nframe_sz to PAGE_SIZE. __xdp_build_skb_from_frame() later treats that\npage like a normal XDP frame and expects the usual skb_shared_info\ntailroom at the end of the buffer.\n\nThe current check only rejects frames whose linear xdp_frame header,\nheadroom, and packet data exceed PAGE_SIZE. A source frame backed by a\nlarger allocation can still satisfy that check while extending into the\nclone's required shared-info area. When such a clone is converted back\ninto an skb, build_skb_around() places skb_shared_info over live packet\nbytes and later writes can corrupt XDP return metadata.\n\nReject clones unless their linear area fits inside\nSKB_WITH_OVERHEAD(PAGE_SIZE), matching the tailroom requirement already\nenforced by the XDP-to-skb conversion path."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nxdp: rechazar clones que exceden el espacio de cola de skb_shared_info\n\nxdpf_clone() clona copias de difusi\u00f3n en una sola p\u00e1gina y establece frame_sz a PAGE_SIZE. __xdp_build_skb_from_frame() m\u00e1s tarde trata esa p\u00e1gina como un frame XDP normal y espera el espacio de cola habitual de skb_shared_info al final del b\u00fafer.\n\nLa comprobaci\u00f3n actual solo rechaza frames cuyo encabezado xdp_frame lineal, espacio inicial y datos de paquete exceden PAGE_SIZE. Un frame de origen respaldado por una asignaci\u00f3n mayor a\u00fan puede satisfacer esa comprobaci\u00f3n mientras se extiende hacia el \u00e1rea de informaci\u00f3n compartida requerida del clon. Cuando dicho clon se convierte de nuevo en un skb, build_skb_around() coloca skb_shared_info sobre bytes de paquete activos y escrituras posteriores pueden corromper los metadatos de retorno de XDP.\n\nRechazar clones a menos que su \u00e1rea lineal quepa dentro de SKB_WITH_OVERHEAD(PAGE_SIZE), coincidiendo con el requisito de espacio de cola ya aplicado por la ruta de conversi\u00f3n de XDP a skb."}], "id": "CVE-2026-74616", "lastModified": "2026-10-16T20:17:47.017", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74616", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T19:02:32.968446Z", "version": "2.0.3"}}]}, "published": "2026-08-22T16:16:34.280", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/58408982fa39f9758124cec169f42854d6f98f35"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/685edea27ac68d08fe4dbd3de74b858d2ad8e830"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ba13763d667e008e185fedf592d53846a5b457d1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e48e8edbef2eb824201495daa5234560f632b23c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ef4b7c7046d29a67090de15af0da0d1ae8d1b192"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f463b6f4957c9c3fd1c75f8d3e5af4879fa609c0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fab820f1691a9e26d9031f18aae1e9ce09078f92"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: xdp: reject clones that overrun skb_shared_info tailroom", "id": "2521461", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521461"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nxdp: reject clones that overrun skb_shared_info tailroom\nxdpf_clone() clones broadcast copies into a single page and sets\nframe_sz to PAGE_SIZE. __xdp_build_skb_from_frame() later treats that\npage like a normal XDP frame and expects the usual skb_shared_info\ntailroom at the end of the buffer.\nThe current check only rejects frames whose linear xdp_frame header,\nheadroom, and packet data exceed PAGE_SIZE. A source frame backed by a\nlarger allocation can still satisfy that check while extending into the\nclone's required shared-info area. When such a clone is converted back\ninto an skb, build_skb_around() places skb_shared_info over live packet\nbytes and later writes can corrupt XDP return metadata.\nReject clones unless their linear area fits inside\nSKB_WITH_OVERHEAD(PAGE_SIZE), matching the tailroom requirement already\nenforced by the XDP-to-skb conversion path.", "A flaw was found in the Linux kernel's XDP (eXpress Data Path) component. When XDP frames are cloned, a specially crafted frame can cause the `skb_shared_info` structure to overwrite live packet data. This improper handling of memory during frame cloning can lead to corruption of XDP return metadata, potentially resulting in system instability or a denial of service."], "name": "CVE-2026-74616", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74616\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74616\nhttps://lore.kernel.org/linux-cve-announce/2026082218-CVE-2026-74616-73b5@gregkh/T"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e624d4ed4aa8cc3c69d1359b0aaea539203ed266,58408982fa39f9758124cec169f42854d6f98f35)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e624d4ed4aa8cc3c69d1359b0aaea539203ed266,685edea27ac68d08fe4dbd3de74b858d2ad8e830)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e624d4ed4aa8cc3c69d1359b0aaea539203ed266,ba13763d667e008e185fedf592d53846a5b457d1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e624d4ed4aa8cc3c69d1359b0aaea539203ed266,ef4b7c7046d29a67090de15af0da0d1ae8d1b192)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e624d4ed4aa8cc3c69d1359b0aaea539203ed266,fab820f1691a9e26d9031f18aae1e9ce09078f92)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e624d4ed4aa8cc3c69d1359b0aaea539203ed266,f463b6f4957c9c3fd1c75f8d3e5af4879fa609c0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e624d4ed4aa8cc3c69d1359b0aaea539203ed266,e48e8edbef2eb824201495daa5234560f632b23c)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.14"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.14)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.216,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.183,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.152,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.104,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.9,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-22T16:45:03.759762+00:00", "updated": "2026-08-25T13:45:04.368628+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-119", "CWE-787"]}