CVE-2026-64355

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the bpf component where devmap broadcast redirects clone packets for all but the last destination. In native XDP, the clone path only copies linear xdp frame data, while fragmented frames maintain skb shared info in tailroom outside the linear area. Cloning these frames leaves the XDP FLAGS HAS FRAGS flag set without valid fragment metadata. Consequently, the free path may interpret uninitialized tail data as skb shared info, resulting in an out-of-bounds access during frame return. This affects the dev map enqueue clone() function for native XDP and the dev map redirect clone() function for generic XDP, where fragmented packets are represented as nonlinear skbs.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.