CVE-2026-23140 bpf, test_run: Subtract size of xdp_frame from allowed metadata size
A flaw in the Linux kernel's BPF test_run allows userspace to trigger memory corruption by supplying excessive metadata size, potentially leading to code execution or system crashes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23140?
CVE-2026-23140 is a medium-severity memory corruption vulnerability in Linux kernel, published on 14 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf, test_run: Subtract size of xdp_frame from allowed metadata size
The xdp_frame structure takes up part of the XDP frame headroom, limiting the size of the metadata. However, in bpf_test_run, we don't take this into account, which makes it possible for userspace to supply a metadata size that is too large (taking up the entire headroom).
If userspace supplies such a large metadata size in live packet mode, the xdp_update_frame_from_buff() call in xdp_test_run_init_page() call will fail, after which packet transmission proceeds with an uninitialised frame structure, leading to the usual Bad Stuff.
The commit in the Fixes tag fixed a related bug where the second check in xdp_update_frame_from_buff() could fail, but did not add any additional constraints on the metadata size. Complete the fix by adding an additional check on the metadata size. Reorder the checks slightly to make the logic clearer and add a comment.
Which versions are affected by CVE-2026-23140?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-23140?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-23140 being exploited?
There is no known exploitation of CVE-2026-23140 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-23140, DEBIAN-CVE-2026-23140, GHSA-f7px-4wwg-382j, ROOT-OS-UBUNTU-2404-CVE-2026-23140, UBUNTU-CVE-2026-23140.