In the Linux kernel, the following vulnerability has been resolved:

net: mvpp2: limit XDP frame size to the RX buffer

mvpp2 has short and long BM pools, and short pool buffers can be smaller
than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with
PAGE_SIZE as frame size.

XDP helpers use frame_sz to validate tail growth and to derive the hard
end of the data area. Advertising PAGE_SIZE for short buffers can let
bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting
memory or later tripping skb tailroom checks.

Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches
the actual buffer backing the packet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
07dd0a7aae7f72af7cec18909581c2bb570edddc affected < a3ee9231ccec6ec3be2de89c56f897055fd9eab1
07dd0a7aae7f72af7cec18909581c2bb570edddc affected < ec8e1e5842bc0dbd4c272761f4db3651eecd0339
07dd0a7aae7f72af7cec18909581c2bb570edddc affected < 3b8b0c3631b19faee53f0d15a49924129b063eec
07dd0a7aae7f72af7cec18909581c2bb570edddc affected < 994bd2b58d2bd08aa97ec0836cc813cfcb00d749
07dd0a7aae7f72af7cec18909581c2bb570edddc affected < 910617a4e67dbdd5fdb39d9dc6a51e491e1b2c3e
07dd0a7aae7f72af7cec18909581c2bb570edddc affected < 9545cc5ef18ca22d031f2f47c157192460652359
07dd0a7aae7f72af7cec18909581c2bb570edddc affected < f3c6aa078927e6fe8121c9c591ddee8716c5305a
Linux Linux affected
Version Status Constraints
5.9 affected —
0 unaffected < 5.9
5.15.210 unaffected ≤ 5.15.*
6.1.176 unaffected ≤ 6.1.*
6.6.143 unaffected ≤ 6.6.*
6.12.94 unaffected ≤ 6.12.*
6.18.36 unaffected ≤ 6.18.*
7.0.13 unaffected ≤ 7.0.*
7.1 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/3b8b0c3631b19faee53f0d15a49924129b063eec cve-icon
https://git.kernel.org/stable/c/910617a4e67dbdd5fdb39d9dc6a51e491e1b2c3e cve-icon
https://git.kernel.org/stable/c/9545cc5ef18ca22d031f2f47c157192460652359 cve-icon
https://git.kernel.org/stable/c/994bd2b58d2bd08aa97ec0836cc813cfcb00d749 cve-icon
https://git.kernel.org/stable/c/a3ee9231ccec6ec3be2de89c56f897055fd9eab1 cve-icon
https://git.kernel.org/stable/c/ec8e1e5842bc0dbd4c272761f4db3651eecd0339 cve-icon
https://git.kernel.org/stable/c/f3c6aa078927e6fe8121c9c591ddee8716c5305a cve-icon
History

Thu, 25 Jun 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119
CWE-122

Thu, 25 Jun 2026 09:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.
Title net: mvpp2: limit XDP frame size to the RX buffer
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-06-25T08:39:19.529Z

Reserved: 2026-06-09T07:44:35.392Z

Link: CVE-2026-53216

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-25T12:00:14Z

Weaknesses