CVE-2026-74616

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the XDP (Express Data Path) implementation where xdpf clone() clones broadcast copies into a single page and sets frame sz to PAGE SIZE. Subsequently, xdp build skb from frame() treats the page as a normal XDP frame and expects the standard skb shared info tailroom at the end of the buffer. Because the existing check only rejects frames where the linear xdp frame header, headroom, and packet data exceed PAGE SIZE, a source frame with a larger allocation can bypass this check while extending into the required shared-info area. During the conversion of such a clone back into an skb (socket buffer), the build skb around() function places skb shared info over active packet bytes, which can lead to the corruption of XDP return metadata.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.