CVE-2026-23140: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-23140 Overview

CVE-2026-23140 is a Linux kernel vulnerability in the BPF subsystem's bpf_test_run code path. The flaw exists in how the kernel validates user-supplied metadata sizes for XDP (eXpress Data Path) test runs. The xdp_frame structure consumes part of the XDP frame headroom, but bpf_test_run does not subtract this size when validating metadata length supplied from userspace.

A local user with permission to invoke BPF test runs in live packet mode can supply an oversized metadata value. This causes xdp_update_frame_from_buff() in xdp_test_run_init_page() to fail, after which packet transmission proceeds with an uninitialized frame structure.

Critical Impact
Local attackers with BPF privileges can trigger kernel memory corruption through an uninitialized xdp_frame structure, resulting in kernel instability or denial of service.

Affected Products

Linux kernel 6.19-rc1 through 6.19-rc5
Linux kernel stable branches prior to fix commits
Distributions shipping vulnerable mainline kernel builds with BPF enabled

Discovery Timeline

2026-02-14 - CVE-2026-23140 published to NVD
2026-03-17 - Last updated in NVD database

Technical Details for CVE-2026-23140

Vulnerability Analysis

The vulnerability resides in the BPF test infrastructure used to validate XDP programs from userspace. XDP frames reserve a fixed amount of headroom, part of which is consumed by the xdp_frame metadata structure itself. The kernel must subtract sizeof(struct xdp_frame) from the allowed metadata size to prevent userspace from claiming the entire headroom.

In bpf_test_run, this subtraction is missing. Userspace can therefore supply a metadata size that exceeds the available space after xdp_frame accounting. In live packet mode, the subsequent call to xdp_update_frame_from_buff() inside xdp_test_run_init_page() fails. The failure path does not abort packet transmission, so the kernel proceeds to transmit using an xdp_frame structure that was never properly initialized.

A prior fix addressed a related check inside xdp_update_frame_from_buff() but did not constrain the metadata size at the entry point. This patch completes the remediation by adding an explicit metadata size check and reordering existing checks for clarity.

Root Cause

The root cause is missing input validation [CWE-noinfo] on the data_size_in and metadata size parameters supplied to bpf_test_run. The validation logic failed to account for sizeof(struct xdp_frame) occupying part of the XDP headroom budget.

Attack Vector

Exploitation requires local access and the privilege to invoke BPF_PROG_TEST_RUN against an XDP program in live packet mode. Typically this requires CAP_BPF or CAP_SYS_ADMIN. An attacker crafts a test run request specifying an oversized metadata length, triggering use of an uninitialized frame structure during packet transmission. The result is kernel memory corruption or panic, producing a high-impact denial of service on the affected host.

No proof-of-concept exploit is publicly available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. See the upstream commit references for the precise patch logic.

Detection Methods for CVE-2026-23140

Indicators of Compromise

Kernel oops or panic messages referencing xdp_test_run_init_page or xdp_update_frame_from_buff in dmesg or /var/log/kern.log.
Unexpected process crashes or system reboots correlated with workloads invoking BPF_PROG_TEST_RUN syscalls.
Audit log entries showing non-root processes with CAP_BPF issuing XDP test run operations with unusually large metadata sizes.

Detection Strategies

Monitor bpf() syscall telemetry for BPF_PROG_TEST_RUN commands targeting XDP program types with abnormal data_size_in or metadata parameters.
Alert on kernel ring buffer messages containing XDP frame initialization failures followed by transmission errors.
Inventory installed kernel versions across the fleet and flag hosts running 6.19-rc1 through 6.19-rc5 or unpatched stable kernels.

Monitoring Recommendations

Enable auditd rules for the bpf syscall and review entries where the command argument indicates test run operations.
Track kernel crash dumps with kdump and review backtraces for the affected XDP code paths.
Correlate eBPF program load events with subsequent kernel instability to identify abuse patterns.

How to Mitigate CVE-2026-23140

Immediate Actions Required

Apply the upstream kernel patches referenced in the vendor advisories to all affected stable and mainline branches.
Restrict CAP_BPF and CAP_SYS_ADMIN to trusted administrative accounts and service identities only.
Disable unprivileged BPF on hosts where it is not required by setting kernel.unprivileged_bpf_disabled=1.

Patch Information

The issue is resolved by the following upstream commits, which add the missing metadata size check and reorder validation for clarity:

Update to a kernel release that incorporates these commits across the relevant stable branches.

Workarounds

Set kernel.unprivileged_bpf_disabled=1 via sysctl to block unprivileged users from invoking BPF operations.
Remove CAP_BPF from container and workload security profiles where XDP test functionality is not required.
Use Linux Security Modules such as SELinux or AppArmor to constrain processes capable of issuing BPF_PROG_TEST_RUN.

bash

# Configuration example
# Disable unprivileged BPF system-wide
echo 'kernel.unprivileged_bpf_disabled=1' | sudo tee /etc/sysctl.d/90-disable-unpriv-bpf.conf
sudo sysctl --system

# Verify the setting is applied
sysctl kernel.unprivileged_bpf_disabled

# Confirm running kernel version against patched releases
uname -r