CVE-2026-23140

In the Linux kernel, the following vulnerability has been resolved:

bpf, test_run: Subtract size of xdp_frame from allowed metadata size

The xdp_frame structure takes up part of the XDP frame headroom, limiting the size of the metadata. However, in bpf_test_run, we don't take this into account, which makes it possible for userspace to supply a metadata size that is too large (taking up the entire headroom).

If userspace supplies such a large metadata size in live packet mode, the xdp_update_frame_from_buff() call in xdp_test_run_init_page() call will fail, after which packet transmission proceeds with an uninitialised frame structure, leading to the usual Bad Stuff.

The commit in the Fixes tag fixed a related bug where the second check in xdp_update_frame_from_buff() could fail, but did not add any additional constraints on the metadata size. Complete the fix by adding an additional check on the metadata size. Reorder the checks slightly to make the logic clearer and add a comment.

A flaw exists in bpf_prog_test_run_xdp when running XDP programs via the bpf_test_run interface in live packet mode. The XDP frame headroom is shared between user supplied metadata and internal bookkeeping struct ures such as struct xdp_frame. Prior to this change, the test_run path validated metadata size without subtracting the space required by struct xdp_frame. As a result, userspace could provide a metadata length large enough to consume the entire headroom. In live packet mode this can cause xdp_update_frame_from_buff called from xdp_test_run_init_page to fail. After that failure, the code could proceed with packet transmission while the xdp_frame structure remained uninitialized. Using an uninitialized frame in the transmit path can lead to kernel crashes and severe instability, resulting in a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.