CVE-2026-23343

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xdp: produce a warning when calculated tailroom is negative

Many ethernet drivers report xdp Rx queue frag size as being the same as

DMA write size. However, the only user of this field, namely

bpf_xdp_frags_increase_tail(), clearly expects a truesize.

Such difference leads to unspecific memory corruption issues under certain

circumstances, e.g. in ixgbevf maximum DMA write size is 3 KB, so when

running xskxceiver's XDP_ADJUST_TAIL_GROW_MULTI_BUFF, 6K packet fully uses

all DMA-writable space in 2 buffers. This would be fine, if only

rxq->frag_size was properly set to 4K, but value of 3K results in a

negative tailroom, because there is a non-zero page offset.

We are supposed to return -EINVAL and be done with it in such case, but due

to tailroom being stored as an unsigned int, it is reported to be somewhere

near UINT_MAX, resulting in a tail being grown, even if the requested

offset is too much (it is around 2K in

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References