The Linux kernel XDP subsystem incorrectly calculates the tailroom when an Ethernet driver reports a fragment size that does not match the expected true size. Because the tailroom is stored as an unsigned integer, a negative value is interpreted as a very large positive number, causing the kernel to grow packet tails beyond the allocated DMA buffer. This overflow leads to unpredictable memory corruption, which manifests as kernel crashes and Oops messages, as highlighted in the provided trace logs.

All Linux kernel builds that include XDP support are potentially affected when a driver such as ixgbevf misreports rxq->frag_size. No specific version identifiers are listed in the advisory, so administrators should assume that any current kernel release that contains XDP and the related drivers remains vulnerable until an official patch is released. The issue arises in user‑space applications that use XDP with the XDP_ADJUST_TAIL_GROW_MULTI_BUFF operation, indicating that any service sending packets through an XDP‑enabled network interface could trigger the flaw.

The CVSS score is 5.5 and the EPSS probability is below 1%, suggesting moderate severity but low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is inferred to be network‑based: an attacker can send specially crafted packets to an XDP‑enabled NIC, triggering the negative tailroom calculation without needing elevated privileges. Successful exploitation would result in kernel crashes and service disruption, but it does not provide a direct path to privilege escalation or remote code execution.