Cloudanix VulnDB

CVE-2026-23377

Medium · 5.5

CVSS

5.5

EPSS

0.2%

Published

Mar 25, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in certain Linux network drivers can let local programs crash the whole system by mishandling network buffer sizes.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Incorrect use of DMA write length instead of full buffer size in XDP RxQ frag_size for the ice driver leads to negative tailroom calculations, enabling out-of-bounds memory access and kernel panic during XDP_ADJUST_TAIL_GROW operations on multi-buffer frames.

Why it matters to the business

Local users or processes on affected Linux systems can trigger kernel crashes, causing denial of service and loss of network availability on systems using the ice network driver with XDP features enabled.

How an attack unfolds

An attacker with local access runs or crafts workloads that invoke bpf_xdp_frags_increase_tail() with large frame sizes and offsets on ice hardware, exploiting the mismatch between assumed DMA length and actual xdp frame size to corrupt memory and panic the kernel.

How to fix it

Apply the upstream kernel fix that replaces DMA write size with fill queue buffer truesize in XDP RxQ info and updates ZC mode handling; rebuild and deploy the patched kernel across all affected systems.

How to confirm the fix worked

Confirm the presence of the corrected frag_size assignment using xdp.frame_sz and truesize helpers in the ice driver source; test with XSK_UMEM__MAX_FRAME_SIZE workloads to verify tailroom growth succeeds without panic.

Typical attack path

  1. Obtain local user or process execution on a Linux host with ice driver and XDP enabled
  2. Load or trigger XDP programs that perform tail growth on multi-buffer frames
  3. Supply packet sizes and offsets exceeding expected DMA lengths (e.g., 6912 bytes and large offsets)
  4. Trigger the frag_size miscalculation leading to negative tailroom and kernel panic

How to detect it

Review kernel logs for panic messages referencing ice driver, XDP, or bpf_xdp_frags_increase_tail; inspect system call traces involving XDP tail adjustments on multi-buffer sockets.

What your security team should do

  • Prioritize patching kernel versions containing the ice XDP RxQ change as soon as available
  • Restrict untrusted local code execution on systems exposing XDP to reduce local attack surface
  • Monitor EPSS trend and re-evaluate if exploit maturity increases

The record

In the Linux kernel, the following vulnerability has been resolved: ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz The only user of frag_size field in XDP RxQ info is bpf_xdp_frags_increase_tail(). It clearly expects whole buff size instead of DMA write size. Different assumptions in ice driver configuration lead to negative tailroom. This allows to trigger kernel panic, when using XDP_ADJUST_TAIL_GROW_MULTI_BUFF xskxceiver test and changing packet size to 6912 and the requested offset to a huge value, e.g. XSK_UMEM__MAX_FRAME_SIZE * 100. Due to other quirks of the ZC configuration in ice, panic is not observed in ZC mode, but tailroom growing still fails when it should not. Use fill queue buffer truesize instead of DMA write size in XDP RxQ info. Fix ZC mode too by using the new helper.

Affected packages

Ecosystem Package Introduced Fixed