The vulnerability in the Linux kernel affects the BPF devmap broadcast redirect functionality. When cloning packets for broadcast, all but the last destination receive a cloned packet. For native XDP, cloning only copies linear xdp_frame data, but fragmented frames store skb_shared_info in tailroom outside this linear area. Cloning such fragmented frames leaves the XDP_FLAGS_HAS_FRAGS flag set without valid fragment metadata, causing the free path to potentially interpret uninitialized tail data as skb_shared_info. This results in an out-of-bounds memory access during frame return. The patch rejects fragmented native XDP frames in dev_map_enqueue_clone() and similarly restricts the generic XDP clone path in dev_map_redirect_clone(), ensuring consistent handling of fragmented packets and preventing the vulnerability.

This vulnerability can lead to out-of-bounds memory access in the Linux kernel when processing fragmented native XDP frames in devmap broadcast redirects. Such memory access issues can cause kernel crashes or undefined behavior, potentially impacting system stability and security. There are no known exploits in the wild at this time.

A fix has been implemented that rejects fragmented native XDP frames in dev_map_enqueue_clone() and applies the same restriction to the generic XDP clone path in dev_map_redirect_clone(). Users should update their Linux kernel to a version that includes this fix once it becomes available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.