The vulnerability involves the XDP framework in the Linux kernel where cloned frames may exceed the tailroom of the skb_shared_info structure. The existing check only verifies that the linear portion of the frame fits within PAGE_SIZE, but a source frame that occupies a larger allocation can still satisfy this condition while overrunning into the required shared‑info area. When such a clone is later converted back into an sk_buff, build_skb_around() places skb_shared_info over live packet bytes. Subsequent writes then corrupt XDP return metadata, leading to kernel memory corruption. The weakness is a buffer overrun in kernel space.

The affected product is the Linux kernel. No specific version information is provided in the CVE entry, so the vulnerability may exist in any kernel release that includes the vulnerable xdpf_clone implementation until it is patched. The patch is applied in the upstream kernel commits referenced in the advisory links.

The vulnerability has a CVSS score of 9.8, indicating very high severity. The exploit would require triggering a clone path that overshoots the expected boundaries, which may be achieved by sending specially crafted XDP frames from a privileged source or from a malicious driver. The EPSS score of less than 1% reflects a very low probability of exploitation in the wild, although the potential for kernel memory corruption remains high if an attacker can trigger the condition. KEV is not listed, indicating no known field‑based exploitation at the time of the advisory.