CVE-2026-64355

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject fragmented frames in devmap

Devmap broadcast redirects clone the packet for all but the last

destination.

For native XDP, that clone path copies only the linear xdp_frame data,

while fragmented frames keep skb_shared_info in tailroom outside the

linear area. Cloning such a frame leaves XDP_FLAGS_HAS_FRAGS set but

without valid frag metadata, and the later free path can interpret

uninitialized tail data as skb_shared_info, leading to an out-of-bounds

access during frame return.

Reject fragmented native XDP frames in dev_map_enqueue_clone().

Add the same restriction to the generic XDP clone path in

dev_map_redirect_clone(). Generic XDP represents fragmented packets as

nonlinear skbs, and rejecting them here keeps clone-based broadcast

support aligned between native and generic XDP.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References