The Linux kernel’s veth driver incorrectly updates the skb length on XDP fragment modifications. When an XDP program shrinks the fragment area, the driver copies the new fragment size into skb->data_len but leaves skb->len unchanged, causing skb_headlen() to report a linear size larger than the actual linear data. During a UDP receive path, __skb_datagram_iter copied 1024 bytes past the true linear tail into user space, exposing kernel pointers and other packet metadata while truncating the real payload. The old code also triggered a SKB_LINEAR_ASSERT when bpf_xdp_pull_data() advanced data_end with fragments still present, potentially causing a kernel crash.

Affected systems include any Linux kernel configuration that exposes the veth driver, irrespective of distribution, for kernel releases built before the fix was applied. The issue is tied to usage of XDP programs that manipulate fragment areas on veth interfaces. No specific version string is provided, but all builds lacking the patch are impacted.

The CVSS score of 10 indicates critical severity, while the EPSS score of <1% suggests a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to load or modify an XDP program on a veth interface, typically requiring CAP_SYS_ADMIN or equivalent eBPF execution rights. Once the flaw is triggered, a local attacker can read kernel memory beyond the packet buffer, leaking pointers and metadata, or cause a kernel crash via SKB_LINEAR_ASSERT, leading to denial of service. The typo in skb length bookkeeping is an out‑of‑bounds read that directly satisfies a CWE‑125 characterization.