CVE-2026-81002

In the Linux kernel, the following vulnerability has been resolved:

xdp: fix zero-copy frame layout

xdp_convert_zc_to_xdp_frame() clones an XSK packet into an order-0 page

and advertises PAGE_SIZE as its frame size. It allows the copied frame

to occupy the page tail needed by skb_shared_info and records zero

headroom even when metadata separates the frame header from packet data.

An AF_XDP zero-copy packet redirected through cpumap can therefore make

the skb overlap skb_shared_info or place it beyond the allocated page.

Limit the copied layout to SKB_WITH_OVERHEAD(PAGE_SIZE) and include the

metadata length in frame headroom. Redirect callers already handle a

NULL conversion result.

BUG: KASAN: slab-out-of-bounds in skb_gro_receive

Write of size 4 at addr ffff88800cf37004 by task cpumap/1/map:1/146

Call Trace:

skb_gro_receive (net/core/gro.c:174)

udp_gro_receive (net/ipv4/udp_offload.c:812)

inet_gro_receive (net/ipv4/af_inet.c:1539)

dev_gro_receive (net/core/gro.c:515)

gro_receive_skb (net/core/gro.c:633)

cpu_map_kthread_run (kernel/bpf/cpumap.c:395)

kthread (kernel/kthread.c:436)

ret_from_fork (arch/x86/kernel/process.c:164)

ret_from_fork_asm (arch/x86/entry/entry_64.S:255)

Kernel panic - not syncing: KASAN: panic_on_warn set ...