CVE-2026-81002: Linux Kernel XDP Buffer Overflow Vulnerability

CVE-2026-81002 Overview

CVE-2026-81002 is an out-of-bounds write vulnerability in the Linux kernel's eXpress Data Path (XDP) subsystem. The flaw resides in xdp_convert_zc_to_xdp_frame(), which clones an AF_XDP zero-copy packet into an order-0 page while advertising PAGE_SIZE as the frame size. This allows the copied frame to occupy the page tail reserved for skb_shared_info and records zero headroom even when metadata separates the frame header from packet data. An AF_XDP zero-copy packet redirected through cpumap can therefore cause the socket buffer to overlap skb_shared_info or extend beyond the allocated page, triggering a slab-out-of-bounds write detected by KASAN.

Critical Impact
Remote, unauthenticated attackers on the network can trigger memory corruption in kernel space, potentially leading to denial of service or arbitrary code execution.

Affected Products

Linux kernel versions incorporating the XDP zero-copy conversion path in net/core/xdp.c
Systems using AF_XDP sockets with zero-copy mode
Kernels leveraging cpumap for XDP packet redirection

Discovery Timeline

2026-09-11 - CVE-2026-81002 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-81002

Vulnerability Analysis

The vulnerability affects the XDP zero-copy frame conversion logic used when redirecting AF_XDP packets through the CPU map. The function xdp_convert_zc_to_xdp_frame() allocates an order-0 page (typically 4096 bytes) to hold the cloned packet but declares the entire PAGE_SIZE as the usable frame size. This declaration ignores the tail space that the kernel reserves for skb_shared_info, a structure required for shared buffer accounting and generic receive offload (GRO) processing.

When the packet is later processed by the GRO path via skb_gro_receive(), writes intended for the shared info region land in memory that has been consumed by the frame payload, or the payload itself extends past the allocated page. KASAN reports this as a slab-out-of-bounds write during udp_gro_receive() and inet_gro_receive() execution within the cpu_map_kthread_run context.

Root Cause

The root cause is an incorrect frame layout calculation. The conversion routine fails to account for SKB_WITH_OVERHEAD(PAGE_SIZE), which represents the true usable payload area after reserving space for skb_shared_info. Additionally, the routine records zero headroom even when XDP metadata is present between the frame start and packet data, causing downstream consumers to miscalculate buffer boundaries.

Attack Vector

An attacker sending crafted network traffic to a host that redirects AF_XDP zero-copy packets through cpumap can trigger the memory corruption remotely. No authentication or user interaction is required. Successful exploitation results in kernel memory corruption, which can cause a kernel panic or, in a controlled exploitation scenario, code execution in kernel context.

No public proof-of-concept exploit is available. The KASAN trace published with the fix demonstrates that the flaw is reachable through standard UDP traffic processed by GRO after XDP redirection. See the kernel commits linked in the technical references for details of the patched layout logic.

Detection Methods for CVE-2026-81002

Indicators of Compromise

Kernel panic messages referencing KASAN: slab-out-of-bounds in skb_gro_receive on hosts with KASAN enabled
Unexpected crashes in cpu_map_kthread_run or dev_gro_receive call paths
Anomalous restarts of network-facing services that rely on AF_XDP sockets

Detection Strategies

Audit running kernels for versions prior to the fix commits listed in the kernel stable tree
Inventory workloads using AF_XDP zero-copy sockets, particularly those combining XSK with cpumap redirection such as high-performance packet processors and DPDK-adjacent applications
Correlate kernel oops reports and dmesg output across fleet monitoring for signatures matching the KASAN trace

Monitoring Recommendations

Forward kernel logs and crash dumps to a centralized logging platform for pattern matching against the documented KASAN signature
Enable KASAN in test and staging kernels to surface latent triggers before production deployment
Monitor host uptime and network kernel thread stability on systems running eBPF and XDP workloads

How to Mitigate CVE-2026-81002

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable commit series as soon as distribution updates become available
Prioritize patching on hosts that expose AF_XDP zero-copy sockets to untrusted network traffic
Track distribution vendor advisories for backported fixes to long-term support kernel branches

Patch Information

The fix limits the copied layout to SKB_WITH_OVERHEAD(PAGE_SIZE) and includes the metadata length in the frame headroom, preventing the socket buffer from overlapping skb_shared_info. Redirect callers already handle a NULL conversion result, so the corrected routine can safely reject frames that no longer fit. The patch has been merged across multiple stable branches; see commits 15d1f3c0, 22092730, 444216da, 68d7cc55, 6de17275, 71283aaa, ced3e18c, and dcb6db9c.

Workarounds

Disable AF_XDP zero-copy mode on affected interfaces and fall back to copy mode until patches are applied
Remove cpumap redirection from XDP programs handling zero-copy traffic where operationally feasible
Restrict network exposure of hosts running vulnerable XDP configurations behind trusted network segments

bash

# Verify installed kernel version and check for AF_XDP zero-copy usage
uname -r
ss -x | grep -i xdp
# Inspect loaded XDP programs and redirection targets
bpftool net show
bpftool map show | grep -i cpumap