CVE-2026-64355 — bpf: Reject fragmented frames in devmap

Back Back to CVE browser

CRITICAL

bpf: Reject fragmented frames in devmap

Published Jul 25, 2026

9.8

CRITICAL

CVSS 3.1

EPSS 0.51%

Description

Devmap broadcast redirects clone the packet for all but the last destination.

For native XDP, that clone path copies only the linear xdp_frame data, while fragmented frames keep skb_shared_info in tailroom outside the linear area. Cloning such a frame leaves XDP_FLAGS_HAS_FRAGS set but without valid frag metadata, and the later free path can interpret uninitialized tail data as skb_shared_info, leading to an out-of-bounds access during frame return.

Reject fragmented native XDP frames in dev_map_enqueue_clone().

Add the same restriction to the generic XDP clone path in dev_map_redirect_clone(). Generic XDP represents fragmented packets as nonlinear skbs, and rejecting them here keeps clone-based broadcast support aligned between native and generic XDP.

Affected products

Vendor Linux Product Linux Default
unaffected
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
Vendor Linux Product Linux Default
affected
- Version
  5.14
  Status
  affected
  Constraints
  -
- Version
  0
  Status
  unaffected
  Constraints
  <5.14
- Version
  5.15.212
  Status
  unaffected
  Constraints
  <=5.15.*
- Version
  6.1.178
  Status
  unaffected
  Constraints
  <=6.1.*
- Version
  6.12.96
  Status
  unaffected
  Constraints
  <=6.12.*
- Version
  6.18.39
  Status
  unaffected
  Constraints
  <=6.18.*
- Version
  6.6.145
  Status
  unaffected
  Constraints
  <=6.6.*
- Version
  7.1.4
  Status
  unaffected
  Constraints
  <=7.1.*
- Version
  7.2
  Status
  unaffected
  Constraints
  <=*

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Linux

unaffected

Version	Status	Constraints
	affected
	affected
	affected
	affected
	affected
	affected
	affected

Linux

affected

Version	Status	Constraints
5.14	affected	-
0	unaffected	<5.14
5.15.212	unaffected	<=5.15.*
6.1.178	unaffected	<=6.1.*
6.12.96	unaffected	<=6.12.*
6.18.39	unaffected	<=6.18.*
6.6.145	unaffected	<=6.6.*
7.1.4	unaffected	<=7.1.*
7.2	unaffected	<=*

Red Hat Enterprise Linux 10

kernel

Affected
Red Hat Enterprise Linux 6

kernel

Not affected
Red Hat Enterprise Linux 7

kernel

Not affected
Red Hat Enterprise Linux 7

kernel-rt

Not affected
Red Hat Enterprise Linux 8

kernel

Affected
Red Hat Enterprise Linux 8

kernel-rt

Affected
Red Hat Enterprise Linux 9

kernel

Affected
Red Hat Enterprise Linux 9

kernel-rt

Affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 10	kernel	Affected	n/a
Red Hat Enterprise Linux 6	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel-rt	Not affected	n/a
Red Hat Enterprise Linux 8	kernel	Affected	n/a
Red Hat Enterprise Linux 8	kernel-rt	Affected	n/a
Red Hat Enterprise Linux 9	kernel	Affected	n/a
Red Hat Enterprise Linux 9	kernel-rt	Affected	n/a

Remediation

No remediation recorded yet.

Metrics

0.51% 0.00513

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00513

Score over time

Jul–Oct 2026

EPSS v5

Percentile over time

EPSS v5

Table of values (2 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.51% (0.00513)	41.54th	v5 (v2026.06.15)
Jul 25, 2026	0.21% (0.00215)	11.99th	v5 (v2026.06.15)

Weaknesses (1)

CWE-125

Out-of-bounds Read

References (12)

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2026-64355		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2507031		Issue Tracking
https://git.kernel.org/stable/c/07a4c11ee8ef4abcb39d922e9e410ae269671cdf		Patch
https://git.kernel.org/stable/c/47baddc856ae7e93a565dd9deeb797999b179466		Patch
https://git.kernel.org/stable/c/51d07c12ca411e692c424ecdabf077f1e61a61be		Patch
https://git.kernel.org/stable/c/a9bb2d9c798cb62a4050a991c27b752770c33afe		Patch
https://git.kernel.org/stable/c/aa496720618f1a6054f1c870bf10b4f6c99bf656		Patch
https://git.kernel.org/stable/c/bccbab36ff228e0825eb85d9b0f9b8434cd0a399		Patch
https://git.kernel.org/stable/c/c5b4f5efcb55c1af3fe44ff712d31b7fb098a831		Patch
https://lore.kernel.org/linux-cve-announce/2026072519-CVE-2026-64355-35d5@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64355
https://www.cve.org/CVERecord?id=CVE-2026-64355