CVE-2026-23377

Vulnerability

In the Linux kernel's ice driver, the frag_size field in XDP RxQ info was incorrectly set to the DMA write length instead of the full buffer size (xdp.frame_sz). The only user of this field is bpf_xdp_frags_increase_tail(), which expects the whole buffer size. This mismatch leads to negative tailroom calculations, which can trigger a kernel panic [1].

Exploitation

The vulnerability can be triggered by using the XDP_ADJUST_TAIL_GROW_MULTI_BUFF xskxceiver test with a packet size of 6912 and a requested offset set to a huge value, such as XSK_UMEM__MAX_FRAME_SIZE * 100. The attack requires the ability to send such crafted packets to a system using the ice driver with XDP zero-copy (ZC) enabled. In ZC mode, the panic is not observed due to other quirks, but tailroom growth still fails when it should not [1].

Impact

A successful exploitation allows an attacker to cause a kernel panic, resulting in a denial of service (DoS). The CVSS v3 score is 5.5 (Medium), indicating a moderate severity with high availability impact but low attack complexity and no privileges required [1].

Mitigation

The fix involves using the fill queue buffer truesize instead of the DMA write size in XDP RxQ info, and correcting the ZC mode using a new helper. The patch has been applied to the Linux kernel stable tree [1][2]. Users should update their kernel to include the commit b0f05100e8795aadd1c0606bae9caefbda070d63 or later.