PT-2026-64576 · Linux · Linux

CVE-2026-64355 · Published 2026-07-25 · Updated 2026-07-25

Mitre

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject fragmented frames in devmap

Devmap broadcast redirects clone the packet for all but the last destination.

For native XDP, that clone path copies only the linear xdp frame data, while fragmented frames keep skb shared info in tailroom outside the linear area. Cloning such a frame leaves XDP FLAGS HAS FRAGS set but without valid frag metadata, and the later free path can interpret uninitialized tail data as skb shared info, leading to an out-of-bounds access during frame return.

Reject fragmented native XDP frames in dev map enqueue clone().

Add the same restriction to the generic XDP clone path in dev map redirect clone(). Generic XDP represents fragmented packets as nonlinear skbs, and rejecting them here keeps clone-based broadcast support aligned between native and generic XDP.

Fix

Related Identifiers

CVE-2026-64355

Affected Products

Linux

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-64355 · Security Note
• https://git.kernel.org/stable/c/47baddc856ae7e93a565dd9deeb797999b179466 · Note
• https://git.kernel.org/stable/c/a9bb2d9c798cb62a4050a991c27b752770c33afe · Note
• https://git.kernel.org/stable/c/bccbab36ff228e0825eb85d9b0f9b8434cd0a399 · Note
• https://git.kernel.org/stable/c/51d07c12ca411e692c424ecdabf077f1e61a61be · Note
• https://git.kernel.org/stable/c/c5b4f5efcb55c1af3fe44ff712d31b7fb098a831 · Note
• https://git.kernel.org/stable/c/07a4c11ee8ef4abcb39d922e9e410ae269671cdf · Note
• https://git.kernel.org/stable/c/aa496720618f1a6054f1c870bf10b4f6c99bf656 · Note