Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: net: fix skb length accounting after generic XDP frag adjustment Generic XDP… (CVE-2026-74665)

The vulnerability (CVE-2026-74665) in the Linux kernel's network subsystem involves incorrect skb length accounting after generic XDP fragment adjustments. Specifically, when an XDP program modifies the fragment area, bpf_prog_run_generic_xdp() updates skb->data_len but leaves skb->len unchanged, causing skb_headlen() to overestimate the linear data length. This leads to __skb_datagram_iter() copying 1024 bytes beyond the actual linear data to userspace, including sensitive kernel memory such as skb_shared_info fields and kernel pointers. The flaw was demonstrated with a 60000-byte UDP datagram on a veth pair with MTU 64000, causing payload corruption. The fix involves adjusting skb->len by subtracting the old data_len and adding the new data_len to keep lengths synchronized, preventing out-of-bounds reads.

The vulnerability allows an attacker to cause an out-of-bounds read in the kernel network stack, leaking kernel memory contents including kernel pointers and fragment metadata to userspace. This can lead to information disclosure and potential further exploitation. The CVSS score of 9.1 indicates high severity with network attack vector, no privileges required, and high confidentiality and integrity impact. There is no indication of availability impact. No known exploits in the wild have been reported.

A fix for this vulnerability has been implemented in the Linux kernel. Users should apply the official kernel updates that include the patch correcting skb length accounting after generic XDP fragment adjustment. Since this is a kernel-level issue, updating to the fixed kernel version is the recommended remediation. No additional mitigations are indicated.