--- cve: "CVE-2026-74616" severity: "CRITICAL" cvss: 9.8 epss: "68.7%" vendor: "Linux" kev: false exploited: false published: "2026-08-22 16:16:34" tags: [cve, security, critical] source: tsecurity.de CVE-Dossier exported: "2026-09-08T10:49:17+02:00" --- # CVE-2026-74616 > 9.8 CRITICAL ## Beschreibung In the Linux kernel, the following vulnerability has been resolved: xdp: reject clones that overrun skb_shared_info tailroom xdpf_clone() clones broadcast copies into a single page and sets frame_sz to PAGE_SIZE. __xdp_build_skb_from_frame() later treats that page like a normal XDP frame and expects the usual skb_shared_info tailroom at the end of the buffer. The current check only rejects frames whose linear xdp_frame header, headroom, and packet data exceed PAGE_SIZE. A source frame backed by a larger allocation can still satisfy that check while extending into the clone's required shared-info area. When such a clone is converted back into an skb, build_skb_around() places skb_shared_info over live packet bytes and later writes can corrupt XDP return metadata. Reject clones unless their linear area fits inside SKB_WITH_OVERHEAD(PAGE_SIZE), matching the tailroom requirement already enforced by the XDP-to-skb conversion path. ## CVSS-Vektor ``` CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H ``` | Metrik | Wert | Bewertung | |---|---|---| | AV Angriffsvektor | Netzwerk | bad | | AC Komplexität | Gering | bad | | PR Privilegien | Keine | bad | | UI Interaktion | Keine | bad | | S Scope | Unverändert | good | | C Vertraulichkeit | Hoch | bad | | I Integrität | Hoch | bad | | A Verfügbarkeit | Hoch | bad | ## Patch verfügbar (OSV) - Kernel ≥ 5.15.216 - Kernel ≥ 6.1.183 - Kernel ≥ 6.6.152 - Kernel ≥ 6.12.104 - Kernel ≥ 6.18.45 - Kernel ≥ 7.1.9 ## Referenzen - - - - - - - --- _Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-74616) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_