CVE-2026-81002

In the Linux kernel, the following vulnerability has been resolved:

xdp: fix zero-copy frame layout

xdp convert zc to xdp frame() clones an XSK packet into an order-0 page and advertises PAGE SIZE as its frame size. It allows the copied frame to occupy the page tail needed by skb shared info and records zero headroom even when metadata separates the frame header from packet data. An AF XDP zero-copy packet redirected through cpumap can therefore make the skb overlap skb shared info or place it beyond the allocated page.

Limit the copied layout to SKB WITH OVERHEAD(PAGE SIZE) and include the metadata length in frame headroom. Redirect callers already handle a NULL conversion result.

BUG: KASAN: slab-out-of-bounds in skb gro receive Write of size 4 at addr ffff88800cf37004 by task cpumap/1/map:1/146 Call Trace: skb gro receive (net/core/gro.c:174) udp gro receive (net/ipv4/udp offload.c:812) inet gro receive (net/ipv4/af inet.c:1539) dev gro receive (net/core/gro.c:515) gro receive skb (net/core/gro.c:633) cpu map kthread run (kernel/bpf/cpumap.c:395) kthread (kernel/kthread.c:436) ret from fork (arch/x86/kernel/process.c:164) ret from fork asm (arch/x86/entry/entry 64.S:255) Kernel panic - not syncing: KASAN: panic on warn set ...