The flaw lies in the UMEM headroom validation performed during XDP UMEM registration. The kernel fails to reserve adequate space for even the smallest Ethernet frame, and does not consider the 128‐byte tailroom required by hardware alignment. This oversight means the tail of an XDP frame can overwrite the skb_shared_info structure that follows the data, potentially corrupting kernel memory. Such corruption could trigger a crash or provide an avenue for privilege escalation if an attacker can supply crafted packets that exploit the missing guard.

All Linux kernel builds where the XDP UMEM interface is enabled are affected, as the vulnerability is present in the generic xdp_umem_reg implementation. No specific kernel version range is listed, so any version requiring this registration path may be compromised until patched.

The CVSS score is not provided, and EPSS is unavailable, so the exact risk rating is unclear. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not been widely reported by exploit communities yet. However, because it involves unchecked writes to kernel memory, the likelihood of exploitation is theoretically high if an attacker can inject malicious frames into the network stack. The attack vector, while not explicitly stated, is inferred to be through network traffic that triggers XDP processing on a system with potentially misconfigured UMEM spaces.