CVE-2026-74616

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> xdp: reject clones that overrun skb_shared_info tailroom<br /> <br /> xdpf_clone() clones broadcast copies into a single page and sets<br /> frame_sz to PAGE_SIZE. __xdp_build_skb_from_frame() later treats that<br /> page like a normal XDP frame and expects the usual skb_shared_info<br /> tailroom at the end of the buffer.<br /> <br /> The current check only rejects frames whose linear xdp_frame header,<br /> headroom, and packet data exceed PAGE_SIZE. A source frame backed by a<br /> larger allocation can still satisfy that check while extending into the<br /> clone&amp;#39;s required shared-info area. When such a clone is converted back<br /> into an skb, build_skb_around() places skb_shared_info over live packet<br /> bytes and later writes can corrupt XDP return metadata.<br /> <br /> Reject clones unless their linear area fits inside<br /> SKB_WITH_OVERHEAD(PAGE_SIZE), matching the tailroom requirement already<br /> enforced by the XDP-to-skb conversion path.