Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-23140— bpf, test_run: Subtract size of xdp_frame from allowed metadata size

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于bpf_test_run未正确计算允许的元数据大小，可能导致未初始化的帧结构和系统不稳定。

AI Predicted 5.5 Difficulty: Easy EPSS 0.14% · P3

Affected Version Matrix 12

VendorProduct Version RangeStatus
Linux Linux b6f1f780b3932ae497ed85e79bc8a1e513883624< e7440935063949d6f2c10f7328d960d0ff4bce90 affected
b6f1f780b3932ae497ed85e79bc8a1e513883624< 7c81ad5e580bd8441f8a521a8d34824ce6582ae5 affected
b6f1f780b3932ae497ed85e79bc8a1e513883624< 6447e697cfa8a43a8e491cb81bcc390d0f28f8ba affected
b6f1f780b3932ae497ed85e79bc8a1e513883624< 31e37f44b60679d90b9f999c91371b15291be8e0 affected
b6f1f780b3932ae497ed85e79bc8a1e513883624< e558cca217790286e799a8baacd1610bda31b261 affected
5.18 affected
< 5.18 unaffected
6.1.161≤ 6.1.* unaffected
… +4 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-23140

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
bpf, test_run: Subtract size of xdp_frame from allowed metadata size
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: bpf, test_run: Subtract size of xdp_frame from allowed metadata size The xdp_frame structure takes up part of the XDP frame headroom, limiting the size of the metadata. However, in bpf_test_run, we don't take this into account, which makes it possible for userspace to supply a metadata size that is too large (taking up the entire headroom). If userspace supplies such a large metadata size in live packet mode, the xdp_update_frame_from_buff() call in xdp_test_run_init_page() call will fail, after which packet transmission proceeds with an uninitialised frame structure, leading to the usual Bad Stuff. The commit in the Fixes tag fixed a related bug where the second check in xdp_update_frame_from_buff() could fail, but did not add any additional constraints on the metadata size. Complete the fix by adding an additional check on the metadata size. Reorder the checks slightly to make the logic clearer and add a comment.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于bpf_test_run未正确计算允许的元数据大小，可能导致未初始化的帧结构和系统不稳定。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux b6f1f780b3932ae497ed85e79bc8a1e513883624 ~ e7440935063949d6f2c10f7328d960d0ff4bce90 -
Linux Linux 5.18 -

II. Public POCs for CVE-2026-23140

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-23140

请登录查看更多情报信息。

Same Patch Batch · Linux · 2026-02-14 · 108 CVEs total

CVE-2025-71202 8.8 HIGH iommu/sva: invalidate stale IOTLB entries for kernel address space
CVE-2026-23193 8.8 HIGH scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()
CVE-2026-23172 8.4 HIGH net: wwan: t7xx: fix potential skb->frags overflow in RX path
CVE-2026-23209 7.8 HIGH macvlan: fix error recovery in macvlan_common_newlink()
CVE-2025-71221 7.8 HIGH dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()
CVE-2026-23178 7.8 HIGH HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report()
CVE-2026-23184 7.8 HIGH binder: fix UAF in binder_netlink_report()
CVE-2026-23185 7.8 HIGH wifi: iwlwifi: mld: cancel mlo_scan_start_wk
CVE-2026-23171 7.8 HIGH bonding: fix use-after-free due to enslave fail after slave array update
CVE-2026-23169 7.8 HIGH mptcp: fix race in mptcp_pm_nl_flush_addrs_doit()
CVE-2026-23191 7.8 HIGH ALSA: aloop: Fix racy access at PCM trigger
CVE-2026-23192 7.8 HIGH linkwatch: use __dev_put() in callers to prevent UAF
CVE-2026-23198 7.8 HIGH KVM: Don't clobber irqfd routing type when deassigning irqfd
CVE-2026-23136 7.5 HIGH libceph: reset sparse-read state in osd_fault()
CVE-2026-23139 7.5 HIGH netfilter: nf_conncount: update last_gc only when GC has been performed
CVE-2025-71204 7.5 HIGH smb/server: fix refcount leak in parse_durable_handle_context()
CVE-2026-23148 7.5 HIGH nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference
CVE-2026-23161 7.3 HIGH mm/shmem, swap: fix race of truncate and swap entry split
CVE-2026-23204 7.1 HIGH net/sched: cls_u32: use skb_header_pointer_careful()
CVE-2025-71201 7.1 HIGH netfs: Fix early read unlock of page with EOF in middle

Showing top 20 of 108 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-23140

No comments yet

Leave a comment