9.8

CVE-2026-81002: linux

CVSS: 9.8v3.1CriticalReceived
AliasesUBUNTU-CVE-2026-81002DEBIAN-CVE-2026-81002
Published 11-09-2026Last modified 19-10-2026
Open JSON

Vulnerability summary

CVE-2026-81002 is a critical (CVSS 9.8) vulnerability in linux. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 42.9% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)
EPSS score
0.51%
0%100%
Low · -0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
OPENSUSE-SU-2026:11880-1

Timeline

  1. 11-09-2026
    PublishedVulnerability first disclosed.
  2. 19-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: xdp: fix zero-copy frame layout xdp_convert_zc_to_xdp_frame() clones an XSK packet into an order-0 page and advertises PAGE_SIZE as its frame size. It allows the copied frame to occupy the page tail needed by skb_shared_info and records zero headroom even when metadata separates the frame header from packet data. An AF_XDP zero-copy packet redirected through cpumap can therefore make the skb overlap skb_shared_info or place it beyond the allocated page. Limit the copied layout to SKB_WITH_OVERHEAD(PAGE_SIZE) and include the metadata length in frame headroom. Redirect callers already handle a NULL conversion result. BUG: KASAN: slab-out-of-bounds in skb_gro_receive Write of size 4 at addr ffff88800cf37004 by task cpumap/1/map:1/146 Call Trace: skb_gro_receive (net/core/gro.c:174) udp_gro_receive (net/ipv4/udp_offload.c:812) inet_gro_receive (net/ipv4/af_inet.c:1539) dev_gro_receive (net/core/gro.c:515) gro_receive_skb (net/core/gro.c:633) cpu_map_kthread_run (kernel/bpf/cpumap.c:395) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:164) ret_from_fork_asm (arch/x86/entry/entry_64.S:255) Kernel panic - not syncing: KASAN: panic_on_warn set ...

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.51%

Chance of exploitation in the next 30 days

Percentile

43%

Versus all other CVEs

30-day change

-0.01 pp

From 0.52% on 22-09-2026

22-09-202622-10-2026
EPSS score
0.51%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu165 products
  • linuxAll versions (No fix recorded)
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded)
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
  • linuxAll versions (No fix recorded) | < 6.1.190-1 | < 6.12.111-1 | < 7.2.6-1
  • linux-6.12< 6.12.111-1~deb12u1
Linux1 product
  • linux≥ b0d1beeff2a97a0cf1965ea8f1d13b8973f22582, < dcb6db9ca6515fcd3e00c93ec5e27dc7a0a7012f | ≥ b0d1beeff2a97a0cf1965ea8f1d13b8973f22582, < 22092730129077c302d8c947bbe0876f0280c528 | ≥ b0d1beeff2a97a0cf1965ea8f1d13b8973f22582, < ced3e18cd9b9caf630aaa1e1eac305f5192ba896 | ≥ b0d1beeff2a97a0cf1965ea8f1d13b8973f22582, < 6de17275b3ccdf9887568b07e54da2e3597217cf | ≥ b0d1beeff2a97a0cf1965ea8f1d13b8973f22582, < 444216dacdbebd3e52d5e704facafbb230da09e9 | ≥ b0d1beeff2a97a0cf1965ea8f1d13b8973f22582, < 15d1f3c0dbe7a740f779337deb39f23cd8d002c8 | ≥ b0d1beeff2a97a0cf1965ea8f1d13b8973f22582, < 68d7cc5512238693670fc19c7a615df631e10edf | ≥ b0d1beeff2a97a0cf1965ea8f1d13b8973f22582, < 71283aaa6c65b3cec84caf1dc78560985737641f | 4.20

3 vendors · 168 products

References

13 links
Show all 13 references