A critical memory corruption vulnerability in the Linux kernel allows unauthenticated remote attackers to trigger potential system crashes or arbitrary code execution.

The vulnerability exists within the xdp_convert_zc_to_xdp_frame function, which incorrectly manages frame layout and headroom during the cloning of XSK packets. This flaw allows an unauthenticated attacker to cause an out of bounds write when an AF_XDP zero copy packet is redirected through cpumap, potentially overwriting critical kernel structures.

Successful exploitation of this vulnerability can lead to a complete system compromise or a kernel panic, resulting in significant service disruption. Given the CVSS score of 9.8, this flaw is considered critical because it permits unauthenticated remote code execution, which could facilitate unauthorized access to sensitive data and lateral movement within the network.

Immediate Action: Update the Linux kernel to version 6.12.109, 6.18.50, 7.2.4, or a later stable release provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel oops or KASAN error reports, specifically looking for slab out of bounds errors related to the cpumap or gro_receive functions.

Compensating Controls: While no direct virtual patch exists, isolating systems that utilize AF_XDP zero copy networking behind robust firewalls may reduce exposure to untrusted traffic.

Public Exploit Available: No

This vulnerability represents a severe risk to infrastructure stability and security. Administrators must prioritize patching the kernel on all affected systems. If immediate patching is not feasible, restrict the use of AF_XDP zero copy features on network-facing interfaces until the security updates are applied.