CVE-2026-23140

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf, test_run: Subtract size of xdp_frame from allowed metadata size

The xdp_frame structure takes up part of the XDP frame headroom,

limiting the size of the metadata. However, in bpf_test_run, we don't

take this into account, which makes it possible for userspace to supply

a metadata size that is too large (taking up the entire headroom).

If userspace supplies such a large metadata size in live packet mode,

the xdp_update_frame_from_buff() call in xdp_test_run_init_page() call

will fail, after which packet transmission proceeds with an

uninitialised frame structure, leading to the usual Bad Stuff.

The commit in the Fixes tag fixed a related bug where the second check

in xdp_update_frame_from_buff() could fail, but did not add any

additional constraints on the metadata size. Complete the fix by adding

an additional check on the metadata size. Reorder the checks slightly to

make the logic clearer and add a comment.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References