The Linux kernel’s AF_XDP implementation accepts zero‑copy pool configurations during bind without verifying that the device MTU fits into the usable frame space of the UMEM chunk. Because tailroom and headroom are now subtracted from the chunk size, a 2k chunk may be insufficient for the standard 1500 MTU. If a packet larger than the available space arrives, the kernel could attempt to copy beyond the buffer boundaries, potentially leading to memory corruption or an unexpected crash, effectively denying service to the host.

All Linux kernel builds that have not incorporated the patch referenced in the commit logs are vulnerable. No specific release numbers are listed, so any kernel lacking the fix should be considered at risk.

An attacker with local privileges or the ability to create AF_XDP sockets can bind a pool with a chunk size that does not accommodate the network interface’s MTU. This undermines buffer bounds safety and could trigger a crash. Based on the CVSS score of 5.5, the vulnerability is considered moderate in severity. The EPSS score is <1%, and the vulnerability is not listed in CISA’s KEV catalog, indicating no known widespread exploitation yet. Based on the description, it is inferred that the lack of MTU validation could allow an attacker to cause a denial of service by forcing a kernel panic.