CVE-2026-81002

A flaw was found in the Linux kernel's XDP (eXpress Data Path) component. Incorrect handling of zero-copy frame layout in the xdp_convert_zc_to_xdp_frame() function can allow an AF_XDP zero-copy packet, when redirected through cpumap, to cause a memory corruption. This can lead to a slab-out-of-bounds error, resulting in a kernel panic and a Denial of Service (DoS) for the system.

This vulnerability is rated as Moderate impact because triggering the flaw requires an unusual network setup utilizing AF_XDP zero-copy sockets paired with BPF cpumap packet redirection, which is not enabled by default in standard Red Hat Enterprise Linux deployments. Additionally, configuring such eBPF programs and AF_XDP socket redirection necessitates elevated local privileges, mitigating the risk of unprivileged or direct remote exploitation. While a crafted packet in this non-standard configuration can cause out-of-bounds memory corruption and kernel instability leading to a denial of service, standard network traffic flows remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.