PT-2026-64576 · Linux · Linux
CVE-2026-64355
·
Publicado
2026-07-25
·
Atualizado
2026-07-25
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject fragmented frames in devmap
Devmap broadcast redirects clone the packet for all but the last
destination.
For native XDP, that clone path copies only the linear xdp frame data,
while fragmented frames keep skb shared info in tailroom outside the
linear area. Cloning such a frame leaves XDP FLAGS HAS FRAGS set but
without valid frag metadata, and the later free path can interpret
uninitialized tail data as skb shared info, leading to an out-of-bounds
access during frame return.
Reject fragmented native XDP frames in dev map enqueue clone().
Add the same restriction to the generic XDP clone path in
dev map redirect clone(). Generic XDP represents fragmented packets as
nonlinear skbs, and rejecting them here keeps clone-based broadcast
support aligned between native and generic XDP.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux