CVE-2026-64355 bpf: Reject fragmented frames in devmap
CriticalCVSS 9.8
EPSS 0.51%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject fragmented frames in devmap
Devmap broadcast redirects clone the packet for all but the last
destination.
For native XDP, that clone path copies only the linear xdp_frame data,
while fragmented frames keep skb_shared_info in tailroom outside the
linear area. Cloning such a frame leaves XDP_FLAGS_HAS_FRAGS set but
without valid frag metadata, and the later free path can interpret
uninitialized tail data as skb_shared_info, leading to an out-of-bounds
access during frame return.
Reject fragmented native XDP frames in dev_map_enqueue_clone().
Add the same restriction to the generic XDP clone path in
dev_map_redirect_clone(). Generic XDP represents fragmented packets as
nonlinear skbs, and rejecting them here keeps clone-based broadcast
support aligned between native and generic XDP.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux kernel | >= e624d4ed4aa8cc3c69d1359b0aaea539203ed266, < 47baddc856ae7e93a565dd9deeb797999b179466 | 47baddc856ae7e93a565dd9deeb797999b179466 |
| Linux kernel | >= e624d4ed4aa8cc3c69d1359b0aaea539203ed266, < 07a4c11ee8ef4abcb39d922e9e410ae269671cdf | 07a4c11ee8ef4abcb39d922e9e410ae269671cdf |
| Linux kernel | >= e624d4ed4aa8cc3c69d1359b0aaea539203ed266, < bccbab36ff228e0825eb85d9b0f9b8434cd0a399 | bccbab36ff228e0825eb85d9b0f9b8434cd0a399 |
| Linux kernel | >= e624d4ed4aa8cc3c69d1359b0aaea539203ed266, < c5b4f5efcb55c1af3fe44ff712d31b7fb098a831 | c5b4f5efcb55c1af3fe44ff712d31b7fb098a831 |
| Linux kernel | >= e624d4ed4aa8cc3c69d1359b0aaea539203ed266, < a9bb2d9c798cb62a4050a991c27b752770c33afe | a9bb2d9c798cb62a4050a991c27b752770c33afe |
| Linux kernel | >= e624d4ed4aa8cc3c69d1359b0aaea539203ed266, < 51d07c12ca411e692c424ecdabf077f1e61a61be | 51d07c12ca411e692c424ecdabf077f1e61a61be |
| Linux kernel | >= e624d4ed4aa8cc3c69d1359b0aaea539203ed266, < aa496720618f1a6054f1c870bf10b4f6c99bf656 | aa496720618f1a6054f1c870bf10b4f6c99bf656 |
| Linux kernel | = 5.14 | No fix listed |
| Linux kernel | < 5.15.212 | 5.15.212 |
| Linux kernel | < 6.1.178 | 6.1.178 |
| Linux kernel | < 6.6.145 | 6.6.145 |
| Linux kernel | < 6.12.96 | 6.12.96 |
| Linux kernel | < 6.18.39 | 6.18.39 |
| Linux kernel | < 7.1.4 | 7.1.4 |
| Linux kernel | < 7.2 | 7.2 |
| redhat/kernel(Red Hat:enterprise_linux:10.3) | < 6.12.0-264.9.1.el10_3 | 6.12.0-264.9.1.el10_3 |
| redhat/kernel(Red Hat:enterprise_linux:9) | < 5.14.0-741.14.1.el9_9 | 5.14.0-741.14.1.el9_9 |
| redhat/kernel(Red Hat:enterprise_linux:8) | All versions | No fix listed |
| redhat/kernel-rt(Red Hat:enterprise_linux:8) | All versions | No fix listed |
| redhat/kernel-rt(Red Hat:enterprise_linux:9) | All versions | No fix listed |
| debian/linux(Debian:12) | < 6.1.180-1 | 6.1.180-1 |
| debian/linux(Debian:12) | = 6.1.106-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.106-2 | No fix listed |
| debian/linux(Debian:12) | = 6.1.106-3 | No fix listed |
| debian/linux(Debian:12) | = 6.1.112-1 | No fix listed |
Show 175 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/linux(Debian:12) | = 6.1.115-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.119-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.123-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.124-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.128-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.129-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.133-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.135-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.137-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.139-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.140-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.147-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.148-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.153-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.158-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.159-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.162-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.164-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.170-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.170-2 | No fix listed |
| debian/linux(Debian:12) | = 6.1.170-3 | No fix listed |
| debian/linux(Debian:12) | = 6.1.172-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.174-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.176-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.177-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.27-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.37-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.38-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.38-2 | No fix listed |
| debian/linux(Debian:12) | = 6.1.38-2~bpo11+1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.38-3 | No fix listed |
| debian/linux(Debian:12) | = 6.1.38-4 | No fix listed |
| debian/linux(Debian:12) | = 6.1.38-4~bpo11+1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.52-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.55-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.55-1~bpo11+1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.64-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.66-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.67-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.69-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.69-1~bpo11+1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.76-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.76-1~bpo11+1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.82-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.85-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.90-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.90-1~bpo11+1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.94-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.94-1~bpo11+1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.98-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.99-1 | No fix listed |
| debian/linux(Debian:13) | < 6.12.96-1 | 6.12.96-1 |
| debian/linux(Debian:13) | = 6.12.38-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.41-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.43-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.43-1~bpo12+1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.48-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.57-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.57-1~bpo12+1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.63-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.63-1~bpo12+1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.69-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.69-1~bpo12+1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.73-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.73-1~bpo12+1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.74-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.74-2 | No fix listed |
| debian/linux(Debian:13) | = 6.12.74-2~bpo12+1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.85-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.85-1~bpo12+1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.86-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.86-1~bpo12+1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.88-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.88-1~bpo12+1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.90-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.90-1~bpo12+1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.90-2 | No fix listed |
| debian/linux(Debian:13) | = 6.12.90-2~bpo12+1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.94-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.94-1~bpo12+1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.95-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.95-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | < 7.1.4-1 | 7.1.4-1 |
| debian/linux(Debian:14) | = 6.12.100-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.101-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.105-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.107-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.111-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.113-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.38-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.41-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.43-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.43-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.48-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.57-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.57-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.63-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.63-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.69-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.69-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.73-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.73-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.74-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.74-2 | No fix listed |
| debian/linux(Debian:14) | = 6.12.74-2~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.85-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.85-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.86-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.86-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.88-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.88-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.90-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.90-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.90-2 | No fix listed |
| debian/linux(Debian:14) | = 6.12.90-2~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.94-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.94-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.95-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.95-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.96-1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.10-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.11-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.2-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.3-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.4-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.5-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.6-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.7-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.8-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.9-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13~rc6-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13~rc7-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.14.3-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.14.5-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.14.6-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.15-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.15.1-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.15.2-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.15.3-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.15.4-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.15.5-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.15.6-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.15~rc7-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.16-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.1-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.10-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.11-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.12-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.12-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.12-2 | No fix listed |
| debian/linux(Debian:14) | = 6.16.3-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.3-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.5-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.6-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.7-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.8-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.9-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16~rc7-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.10-1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.11-1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.12-1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.13-1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.13-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.2-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.5-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.6-1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.7-1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.7-2 | No fix listed |
| debian/linux(Debian:14) | = 6.17.8-1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.8-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.9-1 | No fix listed |
| debian/linux(Debian:14) | = 6.18.1-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.18.10-1 | No fix listed |
| debian/linux(Debian:14) | = 6.18.12-1 | No fix listed |
| debian/linux(Debian:14) | = 6.18.12-1~bpo13+1 | No fix listed |
References
- MSRC Security Update Guide vendor-advisory
- CBL-Mariner Releases vendor-advisory
- USN-9040-1: Linux kernel (Low Latency NVIDIA) vulnerabilities vendor-advisory
- git.kernel.org patch
- git.kernel.org patch
- git.kernel.org patch
- git.kernel.org patch
- git.kernel.org patch
- git.kernel.org patch
- git.kernel.org patch
- Red Hat CVE page vendor-advisory
- RHSA-2026:97040 patch vendor-advisory
- RHSA-2026:97435 patch vendor-advisory
- Red Hat Bugzilla 2507031 issue-tracking
- www.cve.org
- nvd.nist.gov
- lore.kernel.org
- Debian Security Tracker CVE-2026-64355 vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- USN-8726-1 vendor-advisory
- USN-8727-1 vendor-advisory
- USN-8728-1 vendor-advisory
- USN-8760-1 vendor-advisory
- USN-8781-1 vendor-advisory
- USN-8726-2 vendor-advisory
- USN-8726-3 vendor-advisory
- USN-8800-1 vendor-advisory
- USN-8760-2 vendor-advisory
- USN-8728-2 vendor-advisory
- USN-8726-4 vendor-advisory
- USN-8728-3 vendor-advisory
- USN-8876-1 vendor-advisory
- USN-8878-1 vendor-advisory
- USN-8879-1 vendor-advisory
- USN-8877-1 vendor-advisory
- USN-8875-1 vendor-advisory
- USN-8875-2 vendor-advisory
- USN-8917-1 vendor-advisory
- USN-8918-1 vendor-advisory
- USN-8963-1 vendor-advisory
- USN-9066-1: Linux kernel (HWE) vulnerabilities vendor-advisory
- USN-9025-1 vendor-advisory
- USN-9029-1 vendor-advisory
- USN-9024-1 vendor-advisory
- USN-9026-1 vendor-advisory