The mvpp2 driver in the Linux kernel incorrectly sets the frame size for XDP buffers to PAGE_SIZE, even when the buffer is taken from a short BM pool that is smaller than a page. This mismatch allows the helper bpf_xdp_adjust_tail() to extend a packet beyond the actual allocation, potentially overwriting adjacent memory or causing later skb tailroom checks to fail. The primary effect is a memory corruption vulnerability that can lead to kernel instability or data integrity problems. Based on the description, it is inferred that an attacker could trigger this corruption by delivering specially crafted packets that force tail growth beyond the real buffer size, though the exact exploitation path is not detailed in the provided material.

Linux kernel systems that include the mvpp2 network driver, across all distributions that ship this driver. No specific kernel version is identified, so any kernel with the unpatched mvpp2 implementation may be affected.

No EPSS score or KEV listing is available, and the CVSS score is not stated in the provided data, indicating that no publicly known exploit demonstrations exist for this flaw. The lack of exploitation evidence, combined with the requirement that traffic be processed by the XDP path on an affected interface, suggests that the risk depends on whether an attacker can send targeted packets through that path. Overall, the potential impact is significant, but the probability of successful exploitation remains uncertain without further evidence.