The vulnerability involves the XDP framework in the Linux kernel where cloned frames may exceed the tailroom of the skb_shared_info structure. The existing check only verifies that the linear portion of the frame fits within PAGE_SIZE, but a source frame that occupies a larger allocation can still satisfy this condition while overrunning into the required shared‑info area. When such a clone is later converted back into an sk_buff, build_skb_around() places skb_shared_info over live packet bytes. Subsequent writes then corrupt XDP return metadata, leading to kernel memory corruption. The weakness is a buffer overrun in kernel space (CWE‑122/788).

The affected product is the Linux kernel. No specific version information is provided in the CVE entry, so the vulnerability may exist in any kernel release that includes the vulnerable xdpf_clone implementation until it is patched. The patch is applied in the upstream kernel commits referenced in the advisory links.

The exploit would require triggering a clone path that overshoots the expected boundaries, which may be achieved by sending specially crafted XDP frames from a privileged source or from a malicious driver. Because no public exploit has been reported and EPSS data is unavailable, the likelihood of real‑world exploitation remains unclear, but the potential for kernel memory corruption makes the risk severe if exploited. The kernel does not list this entry in the CISA KEV catalog, indicating no known in‑field exploitation at the time of the advisory.