CVE-2026-23343: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-23343 Overview

CVE-2026-23343 is a memory corruption vulnerability in the Linux kernel's eXpress Data Path (XDP) subsystem. The flaw resides in bpf_xdp_frags_increase_tail(), which expects the receive queue frag_size to represent a truesize. Many Ethernet drivers, including ixgbevf, instead report the DMA write size, producing a mismatch. When the calculated tailroom becomes negative, the value is stored in an unsigned integer and wraps around to a value near UINT_MAX. This bypasses the -EINVAL guard and allows the tail of an XDP buffer to grow past the legitimately writable region, producing out-of-bounds writes and unspecified kernel memory corruption [CWE-787].

Critical Impact
A local attacker with the ability to load or trigger XDP programs can corrupt kernel memory, leading to crashes, general protection faults, and potential privilege escalation on affected systems.

Affected Products

Linux kernel 5.18 and later stable branches incorporating bpf_xdp_frags_increase_tail()
Linux kernel 7.0 release candidates rc1 through rc7
Systems using Ethernet drivers that report DMA write size as XDP rxq->frag_size (for example, ixgbevf)

Discovery Timeline

2026-03-25 - CVE-2026-23343 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-23343

Vulnerability Analysis

The Linux XDP framework allows BPF programs to adjust the tail of received frames using bpf_xdp_frags_increase_tail(). That helper computes available tailroom from rxq->frag_size minus the current page offset and frame length. The helper expects frag_size to be the full page truesize, typically 4 KB on x86. Several drivers populate the field with the maximum DMA write size their hardware supports instead. The values can diverge significantly on devices like ixgbevf, which advertises 3 KB DMA writes.

Root Cause

The defect is a signed-to-unsigned conversion error. The computed tailroom is a signed quantity but is stored and compared as an unsigned integer. When the offset plus frame length exceeds the driver-reported frag_size, the subtraction underflows. The resulting value approaches UINT_MAX and is accepted as ample tailroom, so the helper grows the tail by an attacker-controlled amount instead of returning -EINVAL. The semantic gap between truesize and DMA write size is the precondition that triggers the underflow.

Attack Vector

Exploitation requires local access and the ability to attach or invoke an XDP program against an affected driver. The reproducer in the kernel report uses xskxceiver with the XDP_ADJUST_TAIL_GROW_MULTI_BUFF test. A 6 KB packet fills both DMA buffers on ixgbevf, and a subsequent bpf_xdp_adjust_tail call writes roughly 2 KB beyond the legitimate buffer boundary. The result is corrupted neighboring memory and kernel oops traces such as lookup_swap_cgroup_id+0x44 faulting on a non-canonical address, as captured in the upstream report. The vulnerability does not require code to demonstrate the flaw because it is reproducible with the in-tree selftest.

// No verified public exploit code is available.
// See upstream patches referenced below for the corrective logic
// that returns -EINVAL when tailroom would be negative.

Detection Methods for CVE-2026-23343

Indicators of Compromise

Kernel oops or general protection fault entries referencing memory management paths such as zap_pte_range, unmap_page_range, or lookup_swap_cgroup_id shortly after XDP traffic is processed.
Segmentation faults in user-space processes that interact with AF_XDP sockets, including xskxceiver and similar tooling.
Unexpected WARN_ON messages from the XDP subsystem after the patched kernel is deployed, indicating a driver still reporting incorrect frag_size.

Detection Strategies

Inventory hosts running affected kernel versions with drivers known to misreport frag_size, including ixgbevf, and prioritize them for patching.
Monitor dmesg and /var/log/kern.log for XDP-related warnings and oops signatures correlated with BPF program loads.
Audit loaded BPF programs with bpftool prog show to identify XDP attachments on systems that do not require them.

Monitoring Recommendations

Enable kernel crash collection (kdump, pstore) so faults caused by out-of-bounds tail growth can be triaged rather than lost on reboot.
Alert on new XDP program attachments on production hosts using audit rules for the bpf syscall.
Track kernel package versions across the fleet and flag systems still running pre-patch builds.

How to Mitigate CVE-2026-23343

Immediate Actions Required

Apply the upstream kernel fixes referenced below or upgrade to a distribution kernel that incorporates them.
Restrict CAP_BPF and CAP_NET_ADMIN so only trusted accounts can load XDP programs.
Disable XDP attachments on interfaces where the feature is not required, particularly on hosts using ixgbevf.

Patch Information

Linux maintainers shipped corrective commits that make bpf_xdp_frags_increase_tail() validate the computed tailroom as a signed value, return -EINVAL on negative results, and emit a warning so drivers misreporting frag_size are surfaced. Apply one of the following commits or a backport from your distribution: Kernel Patch Commit 01379540452, Kernel Patch Commit 8821e85775, Kernel Patch Commit 94b9da7e9f, Kernel Patch Commit 98cd8b4d0b, Kernel Patch Commit a0fb59f527, and Kernel Patch Commit c7c790a076.

Workarounds

Set kernel.unprivileged_bpf_disabled=1 to block unprivileged BPF program loads on hosts where this restriction is acceptable.
Avoid binding XDP programs to interfaces backed by drivers known to misreport frag_size until the patched kernel is in place.
Where feasible, switch affected workloads to drivers that correctly populate rxq->frag_size as a page truesize.

bash

# Disable unprivileged BPF program loading
sudo sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' | sudo tee /etc/sysctl.d/90-bpf-hardening.conf

# Detach any XDP program from an affected interface (example: eth0)
sudo ip link set dev eth0 xdp off