---
id: CVE-2026-23140
title: 'bpf, test_run: Subtract size of xdp_frame from allowed metadata size'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf, test_run: Subtract size of xdp_frame from allowed metadata size

  The xdp_frame structure takes up part of the XDP frame headroom,
  limiting the size of the metadata…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= b6f1f780b3932ae497ed85e79bc8a1e513883624 <
    e7440935063949d6f2c10f7328d960d0ff4bce90
  - >-
    Linux >= b6f1f780b3932ae497ed85e79bc8a1e513883624 <
    7c81ad5e580bd8441f8a521a8d34824ce6582ae5
  - >-
    Linux >= b6f1f780b3932ae497ed85e79bc8a1e513883624 <
    6447e697cfa8a43a8e491cb81bcc390d0f28f8ba
  - >-
    Linux >= b6f1f780b3932ae497ed85e79bc8a1e513883624 <
    31e37f44b60679d90b9f999c91371b15291be8e0
  - >-
    Linux >= b6f1f780b3932ae497ed85e79bc8a1e513883624 <
    e558cca217790286e799a8baacd1610bda31b261
  - Linux 5.18
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:20:32.068498Z'
published: '2026-02-14'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:23:19.000Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23140'
references:
  - url: 'https://git.kernel.org/stable/c/e7440935063949d6f2c10f7328d960d0ff4bce90'
  - url: 'https://git.kernel.org/stable/c/7c81ad5e580bd8441f8a521a8d34824ce6582ae5'
  - url: 'https://git.kernel.org/stable/c/6447e697cfa8a43a8e491cb81bcc390d0f28f8ba'
  - url: 'https://git.kernel.org/stable/c/31e37f44b60679d90b9f999c91371b15291be8e0'
  - url: 'https://git.kernel.org/stable/c/e558cca217790286e799a8baacd1610bda31b261'
tags:
  - cve.org
epss: 0.00143
epssPercentile: 0.03625
ingestedAt: '2026-11-05T22:38:32.076Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bpf, test_run: Subtract size of xdp_frame from allowed metadata size

The xdp_frame structure takes up part of the XDP frame headroom,
limiting the size of the metadata. However, in bpf_test_run, we don't
take this into account, which makes it possible for userspace to supply
a metadata size that is too large (taking up the entire headroom).

If userspace supplies such a large metadata size in live packet mode,
the xdp_update_frame_from_buff() call in xdp_test_run_init_page() call
will fail, after which packet transmission proceeds with an
uninitialised frame structure, leading to the usual Bad Stuff.

The commit in the Fixes tag fixed a related bug where the second check
in xdp_update_frame_from_buff() could fail, but did not add any
additional constraints on the metadata size. Complete the fix by adding
an additional check on the metadata size. Reorder the checks slightly to
make the logic clearer and add a comment.

## Affected

- `Linux >= b6f1f780b3932ae497ed85e79bc8a1e513883624 < e7440935063949d6f2c10f7328d960d0ff4bce90`
- `Linux >= b6f1f780b3932ae497ed85e79bc8a1e513883624 < 7c81ad5e580bd8441f8a521a8d34824ce6582ae5`
- `Linux >= b6f1f780b3932ae497ed85e79bc8a1e513883624 < 6447e697cfa8a43a8e491cb81bcc390d0f28f8ba`
- `Linux >= b6f1f780b3932ae497ed85e79bc8a1e513883624 < 31e37f44b60679d90b9f999c91371b15291be8e0`
- `Linux >= b6f1f780b3932ae497ed85e79bc8a1e513883624 < e558cca217790286e799a8baacd1610bda31b261`
- `Linux 5.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.