The Linux kernel veth driver exposed non-linear skb fragments through an xdp_buff. When an XDP program adjusted the fragment area, veth_xdp_rcv_skb() incorrectly updated skb->data_len but left skb->len with the old fragment size, causing skb_headlen() to be larger than the actual linear area. This discrepancy allowed __skb_datagram_iter() in the UDP receive path to copy 1024 bytes beyond the linear tail into userspace, including kernel pointers and other sensitive data. The fix involves subtracting the old data_len before replacing it and adding the new data_len afterwards to keep skb->len and skb->data_len synchronized. Additionally, bpf_xdp_pull_data() was corrected to use skb_set_tail_pointer() and explicitly update skb->len to avoid SKB_LINEAR_ASSERT() failures when frags are present. Testing with large UDP datagrams confirmed the fix prevents payload corruption and assertion failures.

This vulnerability could lead to disclosure of kernel memory contents to userspace due to out-of-bounds copying of skb data, including kernel pointers. This may expose sensitive kernel information and potentially aid in further exploitation. The issue affects the integrity of packet data received via veth interfaces when XDP programs manipulate fragments.

A fix for this vulnerability has been implemented in the Linux kernel. Users should update to the fixed kernel version containing this patch to resolve the issue. Since no specific patch version is provided, check the official Linux kernel advisories or vendor updates for the fixed release. No additional mitigations are indicated.