CVE-2026-23377

A flaw was found in the Linux kernel, specifically within the ice network driver and the eXpress Data Path (XDP) component. This vulnerability arises from an incorrect calculation of the frag_size in XDP receive queue information, which can lead to an invalid memory state known as "negative tailroom." A local user can exploit this by manipulating packet sizes and offsets during XDP operations. Successful exploitation can trigger a kernel panic, resulting in a Denial of Service (DoS) for the affected system.

This flaw affects systems with Intel ice network adapters using XDP (eXpress Data Path). The incorrect frag_size calculation (DMA write size vs. buffer truesize) causes bpf_xdp_frags_increase_tail() to compute negative tailroom, leading to memory corruption or kernel panic. Triggerable via XDP_ADJUST_TAIL with specific packet sizes. Requires XDP program loading privileges.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the ice module from being loaded. See https://access.redhat.com/solutions/41278 for instructions.