Critical 9.8Published Sep 11, 2026

CVE-2026-81002xdp: fix zero-copy frame layout

Updated under an hour ago (Oct 27, 2026, 12:20 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: xdp: fix zero-copy frame layout xdp_convert_zc_to_xdp_frame() clones an XSK packet into an order-0 page and advertises PAGE_SIZE as its frame size. It allows the copied frame to occupy the page tail needed by skb_shared_info and records zero headroom even when metadata separates the frame header from packet data. An AF_XDP zero-copy packet redirected through cpumap can therefore make the skb overlap skb_shared_info or place it beyond the allocated page. Limit the copied layout to SKB_WITH_OVERHEAD(PAGE_SIZE) and include the metadata length in frame headroom. Redirect callers already handle a NULL conversion result. BUG: KASAN: slab-out-of-bounds in skb_gro_receive Write of size 4 at addr ffff88800cf37004 by task cpumap/1/map:1/146 Call Trace: skb_gro_receive (net/core/gro.c:174) udp_gro_receive (net/ipv4/udp_offload.c:812) inet_gro_receive (net/ipv4/af_inet.c:1539) dev_gro_receive (net/core/gro.c:515) gro_receive_skb (net/core/gro.c:633) cpu_map_kthread_run (kernel/bpf/cpumap.c:395) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:164) ret_from_fork_asm (arch/x86/entry/entry_64.S:255) Kernel panic - not syncing: KASAN: panic_on_warn set ...

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from b0d1beeff2a97a0cf1965ea8f1d13b8973f22582 before dcb6db9ca6515fcd3e00c93ec5e27dc7a0a7012f; from b0d1beeff2a97a0cf1965ea8f1d13b8973f22582 before 22092730129077c302d8c947bbe0876f0280c528; from b0d1beeff2a97a0cf1965ea8f1d13b8973f22582 before ced3e18cd9b9caf630aaa1e1eac305f5192ba896; from b0d1beeff2a97a0cf1965ea8f1d13b8973f22582 before 6de17275b3ccdf9887568b07e54da2e3597217cf; from b0d1beeff2a97a0cf1965ea8f1d13b8973f22582 before 444216dacdbebd3e52d5e704facafbb230da09e9; from b0d1beeff2a97a0cf1965ea8f1d13b8973f22582 before 15d1f3c0dbe7a740f779337deb39f23cd8d002c8; from b0d1beeff2a97a0cf1965ea8f1d13b8973f22582 before 68d7cc5512238693670fc19c7a615df631e10edf; from b0d1beeff2a97a0cf1965ea8f1d13b8973f22582 before 71283aaa6c65b3cec84caf1dc78560985737641f	CNA record

References

References

https://git.kernel.org/stable/c/dcb6db9ca6515fcd3e00c93ec5e27dc7a0a7012f
https://git.kernel.org/stable/c/22092730129077c302d8c947bbe0876f0280c528
https://git.kernel.org/stable/c/ced3e18cd9b9caf630aaa1e1eac305f5192ba896
https://git.kernel.org/stable/c/6de17275b3ccdf9887568b07e54da2e3597217cf
https://git.kernel.org/stable/c/444216dacdbebd3e52d5e704facafbb230da09e9
https://git.kernel.org/stable/c/15d1f3c0dbe7a740f779337deb39f23cd8d002c8
https://git.kernel.org/stable/c/68d7cc5512238693670fc19c7a615df631e10edf
https://git.kernel.org/stable/c/71283aaa6c65b3cec84caf1dc78560985737641f

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.