CVE-2026-74616 addresses a Linux kernel vulnerability in the XDP (eXpress Data Path) subsystem where the xdpf_clone() function clones broadcast copies into a single page and sets frame_sz to PAGE_SIZE. The function __xdp_build_skb_from_frame() expects the skb_shared_info tailroom at the end of the buffer, but the existing check only rejects frames exceeding PAGE_SIZE in their linear xdp_frame header, headroom, and packet data. A source frame backed by a larger allocation could bypass this check, causing the clone to extend into the shared-info area. When converted back into an skb, this leads to skb_shared_info being placed over live packet bytes, allowing later writes to corrupt XDP return metadata. The vulnerability is mitigated by rejecting clones unless their linear area fits inside SKB_WITH_OVERHEAD(PAGE_SIZE), aligning with the tailroom requirements.

This vulnerability could lead to memory corruption within the XDP subsystem of the Linux kernel, specifically corrupting XDP return metadata. Such corruption could potentially destabilize kernel networking operations or cause undefined behavior. No known exploits in the wild have been reported. The impact is limited to systems running vulnerable Linux kernel versions with XDP enabled and using the affected cloning functionality.

A fix for this vulnerability has been implemented in the Linux kernel by enforcing stricter checks on the size of clones in xdpf_clone(), rejecting those that overrun the skb_shared_info tailroom. Users should apply the official Linux kernel updates that include this fix. Since this is a kernel-level issue, updating to a patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; therefore, check the official Linux kernel advisories or vendor updates for the exact fixed versions and apply them accordingly.