CVE-2026-74665

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the network subsystem where generic XDP exposes non-linear skb fragments through an xdp buff. When an XDP program adjusts the fragment area, the bpf prog run generic xdp() function updates skb->data len using xdp frags size but fails to update skb->len. This discrepancy causes skb headlen() to report a size larger than the actual linear area after a fragment shrink. Consequently, in the UDP receive path, the skb datagram iter() function may copy data beyond the actual linear tail to userspace, potentially exposing sensitive kernel information such as nr frags, xdp frags size, and kernel pointers from skb shinfo(skb)->frags[0], while displacing and truncating actual packet data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.