DEBIAN-CVE-2026-81002

In the Linux kernel, the following vulnerability has been resolved:  xdp: fix zero-copy frame layout  xdpconvertzctoxdpframe() clones an XSK packet into an order-0 page and advertises PAGESIZE as its frame size.  It allows the copied frame to occupy the page tail needed by skbsharedinfo and records zero headroom even when metadata separates the frame header from packet data. An AFXDP zero-copy packet redirected through cpumap can therefore make the skb overlap skbsharedinfo or place it beyond the allocated page.  Limit the copied layout to SKBWITHOVERHEAD(PAGESIZE) and include the metadata length in frame headroom.  Redirect callers already handle a NULL conversion result.  BUG: KASAN: slab-out-of-bounds in skbgroreceive Write of size 4 at addr ffff88800cf37004 by task cpumap/1/map:1/146 Call Trace:  skbgroreceive (net/core/gro.c:174)  udpgroreceive (net/ipv4/udpoffload.c:812)  inetgroreceive (net/ipv4/afinet.c:1539)  devgroreceive (net/core/gro.c:515)  groreceiveskb (net/core/gro.c:633)  cpumapkthreadrun (kernel/bpf/cpumap.c:395)  kthread (kernel/kthread.c:436)  retfromfork (arch/x86/kernel/process.c:164)  retfromforkasm (arch/x86/entry/entry64.S:255) Kernel panic - not syncing: KASAN: panicon_warn set ...