Cloudanix VulnDB

CVE-2026-23343

High · 7.8

CVSS

7.8

EPSS

0.1%

Published

Mar 25, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in the Linux kernel's network handling can let programs running on the same machine crash the whole system or corrupt data.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Unsigned integer underflow when computing tailroom in bpf_xdp_frags_increase_tail allows out-of-bounds writes and memory corruption in XDP receive paths.

Why it matters to the business

Local processes can crash the kernel or corrupt memory on systems using XDP and AF_XDP sockets, causing network service outages and potential local privilege escalation.

How an attack unfolds

A local attacker invokes XDP tail adjustment operations with parameters that produce a negative tailroom value; because the field is unsigned the kernel treats it as a huge positive offset, performs invalid memory writes, and triggers general protection faults or segfaults that may be turned into code execution.

How to fix it

Upgrade to a Linux kernel containing the fix that validates tailroom before use and returns -EINVAL on negative values; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Confirm the running kernel contains the commit that adds the negative-tailroom warning and early return; re-run XDP tail-adjustment tests and verify no oops or segfaults occur.

Typical attack path

  1. Local user runs an XDP program or test harness that calls bpf_xdp_frags_increase_tail with oversized offset
  2. Driver reports frag_size equal to DMA write size instead of true size
  3. Tailroom calculation underflows and wraps to near UINT_MAX
  4. Kernel writes beyond allocated buffers
  5. Resulting memory corruption leads to oops, crash, or exploitable state

How to detect it

Search kernel logs for oops messages mentioning lookup_swap_cgroup_id, general protection faults, or XDP tail operations; inspect crash dumps for xskxceiver or similar XDP test processes and stack traces containing bpf_xdp_frags_increase_tail.

  • lookup_swap_cgroup_id+0x44/0x80
  • bpf_xdp_frags_increase_tail
  • segfault at .* xskxceiver
  • Oops: general protection fault.*XDP
  • rxq->frag_size

What your security team should do

  • Prioritize kernel update on any host exposing XDP or AF_XDP sockets
  • Temporarily disable XDP workloads until patched kernels are deployed
  • Add kernel oops and XDP-related crash monitoring to existing alerting

The record

In the Linux kernel, the following vulnerability has been resolved: xdp: produce a warning when calculated tailroom is negative Many ethernet drivers report xdp Rx queue frag size as being the same as DMA write size. However, the only user of this field, namely bpf_xdp_frags_increase_tail(), clearly expects a truesize. Such difference leads to unspecific memory corruption issues under certain circumstances, e.g. in ixgbevf maximum DMA write size is 3 KB, so when running xskxceiver's XDP_ADJUST_TAIL_GROW_MULTI_BUFF, 6K packet fully uses all DMA-writable space in 2 buffers. This would be fine, if only rxq->frag_size was properly set to 4K, but value of 3K results in a negative tailroom, because there is a non-zero page offset. We are supposed to return -EINVAL and be done with it in such case, but due to tailroom being stored as an unsigned int, it is reported to be somewhere near UINT_MAX, resulting in a tail being grown, even if the requested offset is too much (it is around 2K in the abovementioned test). This later leads to all kinds of unspecific calltraces. [ 7340.337579] xskxceiver[1440]: segfault at 1da718 ip 00007f4161aeac9d sp 00007f41615a6a00 error 6 [ 7340.338040] xskxceiver[1441]: segfault at 7f410000000b ip 00000000004042b5 sp 00007f415bffecf0 error 4 [ 7340.338179] in libc.so.6[61c9d,7f4161aaf000+160000] [ 7340.339230] in xskxceiver[42b5,400000+69000] [ 7340.340300] likely on CPU 6 (core 0, socket 6) [ 7340.340302] Code: ff ff 01 e9 f4 fe ff ff 0f 1f 44 00 00 4c 39 f0 74 73 31 c0 ba 01 00 00 00 f0 0f b1 17 0f 85 ba 00 00 00 49 8b 87 88 00 00 00 <4c> 89 70 08 eb cc 0f 1f 44 00 00 48 8d bd f0 fe ff ff 89 85 ec fe [ 7340.340888] likely on CPU 3 (core 0, socket 3) [ 7340.345088] Code: 00 00 00 ba 00 00 00 00 be 00 00 00 00 89 c7 e8 31 ca ff ff 89 45 ec 8b 45 ec 85 c0 78 07 b8 00 00 00 00 eb 46 e8 0b c8 ff ff <8b> 00 83 f8 69 74 24 e8 ff c7 ff ff 8b 00 83 f8 0b 74 18 e8 f3 c7 [ 7340.404334] Oops: general protection fault, probably for non-canonical address 0x6d255010bdffc: 0000 [#1] SMP NOPTI [ 7340.405972] CPU: 7 UID: 0 PID: 1439 Comm: xskxceiver Not tainted 6.19.0-rc1+ #21 PREEMPT(lazy) [ 7340.408006] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-5.fc42 04/01/2014 [ 7340.409716] RIP: 0010:lookup_swap_cgroup_id+0x44/0x80 [ 7340.410455] Code: 83 f8 1c 73 39 48 ba ff ff ff ff ff ff ff 03 48 8b 04 c5 20 55 fa bd 48 21 d1 48 89 ca 83 e1 01 48 d1 ea c1 e1 04 48 8d 04 90 <8b> 00 48 83 c4 10 d3 e8 c3 cc cc cc cc 31 c0 e9 98 b7 dd 00 48 89 [ 7340.412787] RSP: 0018:ffffcc5c04f7f6d0 EFLAGS: 00010202 [ 7340.413494] RAX: 0006d255010bdffc RBX: ffff891f477895a8 RCX: 0000000000000010 [ 7340.414431] RDX: 0001c17e3fffffff RSI: 00fa070000000000 RDI: 000382fc7fffffff [ 7340.415354] RBP: 00fa070000000000 R08: ffffcc5c04f7f8f8 R09: ffffcc5c04f7f7d0 [ 7340.416283] R10: ffff891f4c1a7000 R11: ffffcc5c04f7f9c8 R12: ffffcc5c04f7f7d0 [ 7340.417218] R13: 03ffffffffffffff R14: 00fa06fffffffe00 R15: ffff891f47789500 [ 7340.418229] FS: 0000000000000000(0000) GS:ffff891ffdfaa000(0000) knlGS:0000000000000000 [ 7340.419489] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 7340.420286] CR2: 00007f415bfffd58 CR3: 0000000103f03002 CR4: 0000000000772ef0 [ 7340.421237] PKRU: 55555554 [ 7340.421623] Call Trace: [ 7340.421987] <TASK> [ 7340.422309] ? softleaf_from_pte+0x77/0xa0 [ 7340.422855] swap_pte_batch+0xa7/0x290 [ 7340.423363] zap_nonpresent_ptes.constprop.0.isra.0+0xd1/0x270 [ 7340.424102] zap_pte_range+0x281/0x580 [ 7340.424607] zap_pmd_range.isra.0+0xc9/0x240 [ 7340.425177] unmap_page_range+0x24d/0x420 [ 7340.425714] unmap_vmas+0xa1/0x180 [ 7340.426185] exit_mmap+0xe1/0x3b0 [ 7340.426644] __mmput+0x41/0x150 [ 7340.427098] exit_mm+0xb1/0x110 [ 7340.427539] do_exit+0x1b2/0x460 [ 7340.427992] do_group_exit+0x2d/0xc0 [ 7340.428477] get_signal+0x79d/0x7e0 [ 7340.428957] arch_do_signal_or_restart+0x34/0x100 [ 7340.429571] exit_to_user_mode_loop+0x8e/0x4c0 [ 7340.430159] do_syscall_64+0x188/ ---truncated---

Affected packages

Ecosystem Package Introduced Fixed
openSUSE:Leap 16.0 dtb-aarch64 0 6.12.0-160000.28.1
openSUSE:Leap 16.0 kernel-64kb 0 6.12.0-160000.28.1
openSUSE:Leap 16.0 kernel-azure 0 6.12.0-160000.28.1
openSUSE:Leap 16.0 kernel-default 0 6.12.0-160000.28.1
openSUSE:Leap 16.0 kernel-default-base 0 6.12.0-160000.27.1.160000.2.8
openSUSE:Leap 16.0 kernel-docs 0 6.12.0-160000.28.1
openSUSE:Leap 16.0 kernel-kvmsmall 0 6.12.0-160000.28.1
openSUSE:Leap 16.0 kernel-obs-build 0 6.12.0-160000.28.1
openSUSE:Leap 16.0 kernel-obs-qa 0 6.12.0-160000.28.1
openSUSE:Leap 16.0 kernel-rt 0 6.12.0-160000.28.1
openSUSE:Leap 16.0 kernel-source 0 6.12.0-160000.28.1
openSUSE:Leap 16.0 kernel-syms 0 6.12.0-160000.28.1
openSUSE:Leap 16.0 kernel-zfcpdump 0 6.12.0-160000.28.1

Related vulnerabilities