Bug 2467004 (CVE-2026-43093) - CVE-2026-43093 kernel: xsk: tighten UMEM headroom validation to account for tailroom and min frame
Summary: CVE-2026-43093 kernel: xsk: tighten UMEM headroom validation to account for t...
Keywords:
Status: NEW
Alias: CVE-2026-43093
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-05-06 10:02 UTC by OSIDB Bzimport
Modified: 2026-05-06 14:17 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-05-06 10:02:45 UTC
In the Linux kernel, the following vulnerability has been resolved:

xsk: tighten UMEM headroom validation to account for tailroom and min frame

The current headroom validation in xdp_umem_reg() could leave us with
insufficient space dedicated to even receive minimum-sized ethernet
frame. Furthermore if multi-buffer would come to play then
skb_shared_info stored at the end of XSK frame would be corrupted.

HW typically works with 128-aligned sizes so let us provide this value
as bare minimum.

Multi-buffer setting is known later in the configuration process so
besides accounting for 128 bytes, let us also take care of tailroom space
upfront.


Note You need to log in before you can comment on or make changes to this bug.