CVE-2026-81002

In the Linux kernel, the following vulnerability has been resolved:

xdp: fix zero-copy frame layout

xdpconvertzctoxdp_frame() clones an XSK packet into an order-0 page

and advertises PAGE_SIZE as its frame size.  It allows the copied frame

to occupy the page tail needed by skbsharedinfo and records zero

headroom even when metadata separates the frame header from packet data.

An AF_XDP zero-copy packet redirected through cpumap can therefore make

the skb overlap skbsharedinfo or place it beyond the allocated page.

Limit the copied layout to SKBWITHOVERHEAD(PAGE_SIZE) and include the

metadata length in frame headroom.  Redirect callers already handle a

NULL conversion result.

BUG: KASAN: slab-out-of-bounds in skbgroreceive

Write of size 4 at addr ffff88800cf37004 by task cpumap/1/map:1/146

Call Trace:

 skbgroreceive (net/core/gro.c:174)

 udpgroreceive (net/ipv4/udp_offload.c:812)

 inetgroreceive (net/ipv4/af_inet.c:1539)

 devgroreceive (net/core/gro.c:515)

 groreceiveskb (net/core/gro.c:633)

 cpumapkthread_run (kernel/bpf/cpumap.c:395)

 kthread (kernel/kthread.c:436)

 retfromfork (arch/x86/kernel/process.c:164)

 retfromforkasm (arch/x86/entry/entry64.S:255)

Kernel panic - not syncing: KASAN: paniconwarn set ...