The Linux kernel networking stack contained a flaw in how it updates socket buffer (skb) length counters after XDP fragment adjustments. When an XDP program reduces the size of a packet’s fragment area, the kernel copies the new fragment size into skb->data_len but leaves skb->len unchanged. This mismatch causes skb_headlen() to indicate a larger linear area than actually exists. During a UDP receive operation, this led to __skb_datagram_iter() copying up to 1024 bytes past the true data boundary into user space, leaking kernel structured data such as skb_shinfo and fragment metadata, while also truncating and corrupting the real payload.

All Linux kernel builds that expose non‑linear skb fragments to generic XDP programs and that lack the latest commit introducing the skb accounting fix. No specific release series or version numbers are enumerated; the fix is present in kernel revisions that incorporate the referenced commit entries.

The CVSS score of 9.1 and an EPSS of < 1 % indicate a high‑severity bug with a very low likelihood of exploitation in the wild. The vulnerability is not yet listed in CISA's KEV catalog. Based on the description, it is inferred that the attacker must be able to load or otherwise influence an XDP program that modifies packet fragments, typically requiring privileged access or the ability to run trusted eBPF code. The likely attack vector is through locally privileged or trusted users who can inject or modify eBPF programs on interfaces that handle fragmented traffic. If such privileges are available, the flaw can lead to the leaking of kernel pointers and fragment metadata to user space, resulting in information disclosure of kernel address space and exfiltration of packet data. Because the exploitation requires XDP program modifications, the risk to hosts that restrict eBPF loading to trusted users is significantly reduced.