The flaw lies in the UMEM headroom validation performed during XDP UMEM registration. The kernel fails to reserve adequate space for even the smallest Ethernet frame, and does not consider the 128‑byte tailroom required by hardware alignment. This oversight means the tail of an XDP frame can overwrite the skb_shared_info structure that follows the data, potentially corrupting kernel memory. The issue involves an incorrect buffer size calculation (CWE-131). Such corruption could trigger a crash or lead to denial of service.

All Linux kernel builds where the XDP UMEM interface is enabled are affected, as the vulnerability is present in the generic xdp_umem_reg implementation. No specific kernel version range is listed, so any version requiring this registration path may be compromised until patched.

The CVSS score of 7.8 indicates a high potential impact. The EPSS score of <1% suggests a low probability of exploitation at the current time. The vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploits. Based on the description, it is inferred that the flaw could allow an attacker who can inject malicious packets into the network stack to trigger memory corruption in the kernel through XDP processing on a system with misconfigured UMEM spaces. The likelihood of successful exploitation depends on the attacker’s ability to influence this specific XDP path, a conclusion drawn from the input.