CVE-2026-64355: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64355 Overview

CVE-2026-64355 is a Linux kernel vulnerability in the Berkeley Packet Filter (BPF) subsystem. The flaw resides in the devmap broadcast redirect path used by eXpress Data Path (XDP) programs. When a fragmented native XDP frame is cloned for broadcast, the clone routine copies only the linear xdp_frame data. The resulting clone retains the XDP_FLAGS_HAS_FRAGS flag without valid fragment metadata. The subsequent free path interprets uninitialized tail data as skb_shared_info, causing an out-of-bounds access during frame return. The fix rejects fragmented frames in dev_map_enqueue_clone() and applies the same restriction to dev_map_redirect_clone() for the generic XDP path.

Critical Impact
Local attackers with the ability to load or trigger BPF/XDP programs can trigger kernel memory corruption, leading to denial of service or potential privilege escalation on affected Linux systems.

Affected Products

Linux kernel versions containing the devmap broadcast redirect implementation with XDP multi-buffer support
Distributions shipping affected upstream kernels prior to the referenced fix commits
Systems running BPF/XDP programs that use devmap broadcast redirects

Discovery Timeline

2026-07-25 - CVE-2026-64355 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64355

Vulnerability Analysis

The vulnerability affects the BPF devmap broadcast redirect mechanism, which duplicates a packet for delivery to multiple destination interfaces. For every destination except the last, the kernel clones the packet before forwarding. In native XDP mode, this clone operation copies only the linear portion of the xdp_frame structure.

Fragmented XDP frames (multi-buffer XDP) store fragment metadata in skb_shared_info located in the tailroom outside the linear data area. Because the clone routine does not copy this shared-info region, the cloned frame carries the XDP_FLAGS_HAS_FRAGS flag while the tailroom contains uninitialized data. When the frame is eventually returned via the frame free path, the kernel dereferences the tailroom as a valid skb_shared_info structure, producing an out-of-bounds read of kernel memory.

Attackers with network reachability to an interface driven by an XDP program that performs devmap broadcast redirects can supply fragmented frames that trigger the corruption. The consequences include kernel panic, information disclosure, or exploitation primitives that lead to privilege escalation.

Root Cause

The root cause is missing validation in dev_map_enqueue_clone() and dev_map_redirect_clone(). Neither function accounted for XDP multi-buffer frames when cloning packets for broadcast. The clone path duplicates only the linear xdp_frame and never propagates skb_shared_info, breaking the invariant that XDP_FLAGS_HAS_FRAGS implies valid fragment metadata in tailroom.

Attack Vector

An attacker sends fragmented network traffic to an interface handled by an XDP program that redirects packets through a devmap with broadcast semantics. The kernel clones the fragmented frame, retains the frags flag, and later frees the clone. The free path reads skb_shared_info from uninitialized tailroom, triggering out-of-bounds access in kernel context. Exploitation requires no authentication because the trigger is a network packet processed by the XDP hook. The vulnerability requires an existing XDP configuration that uses devmap broadcast redirects.

The patch in commits 07a4c11, 47baddc, 51d07c12, a9bb2d9, aa49672, bccbab36, and c5b4f5ef rejects fragmented frames at the clone entry point, aligning behavior between native and generic XDP.

Detection Methods for CVE-2026-64355

Indicators of Compromise

Kernel oops or panic messages referencing dev_map_enqueue_clone, dev_map_redirect_clone, xdp_return_frame, or skb_shared_info in dmesg output
KASAN reports flagging out-of-bounds reads in the XDP frame return path
Unexpected crashes on hosts running XDP programs with BPF_F_BROADCAST redirects while processing fragmented traffic

Detection Strategies

Inventory loaded BPF programs and identify XDP programs performing bpf_redirect_map() calls against devmaps with broadcast flags
Enable KASAN and kernel lockdep on test kernels to surface the out-of-bounds access during fuzzing of XDP paths
Correlate network fragmentation anomalies with kernel stability events on hosts running XDP-based load balancers or forwarders

Monitoring Recommendations

Forward kernel logs and crash dumps to a centralized SIEM for pattern analysis across XDP-enabled hosts
Monitor bpftool prog show and bpftool map show output to detect unexpected additions of devmap objects
Track running kernel versions across the fleet to identify hosts that have not received the fix commits

How to Mitigate CVE-2026-64355

Immediate Actions Required

Apply the upstream Linux kernel patches or the distribution security update that includes commits 07a4c11, 47baddc, 51d07c12, a9bb2d9, aa49672, bccbab36, and c5b4f5ef
Restrict CAP_BPF and CAP_NET_ADMIN privileges to trusted administrators to reduce the attack surface for loading XDP programs
Audit deployed XDP programs to identify those using devmap broadcast redirects, and validate whether multi-buffer XDP is required

Patch Information

The fix is available in upstream Linux kernel stable trees. Reference commits include 07a4c11, 47baddc, 51d07c12, a9bb2d9, aa49672, bccbab36, and c5b4f5ef. Consult your distribution's security tracker for backported package versions.

Workarounds

Disable XDP multi-buffer support on affected drivers where feasible until patches can be deployed
Remove or reconfigure XDP programs to avoid BPF_F_BROADCAST redirects on devmaps until the fix is applied
Enforce path MTU on upstream network paths to reduce the arrival of fragmented frames at XDP-enabled interfaces

bash

# Identify running kernel version and loaded XDP programs
uname -r
bpftool prog show | grep -i xdp
bpftool map show | grep -i devmap

# Remove an XDP program from an interface as a temporary mitigation
ip link set dev eth0 xdp off