CVE-2026-81002 (GCVE-0-2026-81002)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:42 – Updated: 2026-09-14 11:59
VLAI
Title
xdp: fix zero-copy frame layout
Summary
In the Linux kernel, the following vulnerability has been resolved: xdp: fix zero-copy frame layout xdp_convert_zc_to_xdp_frame() clones an XSK packet into an order-0 page and advertises PAGE_SIZE as its frame size. It allows the copied frame to occupy the page tail needed by skb_shared_info and records zero headroom even when metadata separates the frame header from packet data. An AF_XDP zero-copy packet redirected through cpumap can therefore make the skb overlap skb_shared_info or place it beyond the allocated page. Limit the copied layout to SKB_WITH_OVERHEAD(PAGE_SIZE) and include the metadata length in frame headroom. Redirect callers already handle a NULL conversion result. BUG: KASAN: slab-out-of-bounds in skb_gro_receive Write of size 4 at addr ffff88800cf37004 by task cpumap/1/map:1/146 Call Trace: skb_gro_receive (net/core/gro.c:174) udp_gro_receive (net/ipv4/udp_offload.c:812) inet_gro_receive (net/ipv4/af_inet.c:1539) dev_gro_receive (net/core/gro.c:515) gro_receive_skb (net/core/gro.c:633) cpu_map_kthread_run (kernel/bpf/cpumap.c:395) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:164) ret_from_fork_asm (arch/x86/entry/entry_64.S:255) Kernel panic - not syncing: KASAN: panic_on_warn set ...
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b0d1beeff2a97a0cf1965ea8f1d13b8973f22582 , < dcb6db9ca6515fcd3e00c93ec5e27dc7a0a7012f (git)
Affected: b0d1beeff2a97a0cf1965ea8f1d13b8973f22582 , < 22092730129077c302d8c947bbe0876f0280c528 (git)
Affected: b0d1beeff2a97a0cf1965ea8f1d13b8973f22582 , < ced3e18cd9b9caf630aaa1e1eac305f5192ba896 (git)
Affected: b0d1beeff2a97a0cf1965ea8f1d13b8973f22582 , < 6de17275b3ccdf9887568b07e54da2e3597217cf (git)
Affected: b0d1beeff2a97a0cf1965ea8f1d13b8973f22582 , < 444216dacdbebd3e52d5e704facafbb230da09e9 (git)
Affected: b0d1beeff2a97a0cf1965ea8f1d13b8973f22582 , < 15d1f3c0dbe7a740f779337deb39f23cd8d002c8 (git)
Affected: b0d1beeff2a97a0cf1965ea8f1d13b8973f22582 , < 68d7cc5512238693670fc19c7a615df631e10edf (git)
Affected: b0d1beeff2a97a0cf1965ea8f1d13b8973f22582 , < 71283aaa6c65b3cec84caf1dc78560985737641f (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.20
Unaffected: 0 , < 4.20 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/xdp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dcb6db9ca6515fcd3e00c93ec5e27dc7a0a7012f",
              "status": "affected",
              "version": "b0d1beeff2a97a0cf1965ea8f1d13b8973f22582",
              "versionType": "git"
            },
            {
              "lessThan": "22092730129077c302d8c947bbe0876f0280c528",
              "status": "affected",
              "version": "b0d1beeff2a97a0cf1965ea8f1d13b8973f22582",
              "versionType": "git"
            },
            {
              "lessThan": "ced3e18cd9b9caf630aaa1e1eac305f5192ba896",
              "status": "affected",
              "version": "b0d1beeff2a97a0cf1965ea8f1d13b8973f22582",
              "versionType": "git"
            },
            {
              "lessThan": "6de17275b3ccdf9887568b07e54da2e3597217cf",
              "status": "affected",
              "version": "b0d1beeff2a97a0cf1965ea8f1d13b8973f22582",
              "versionType": "git"
            },
            {
              "lessThan": "444216dacdbebd3e52d5e704facafbb230da09e9",
              "status": "affected",
              "version": "b0d1beeff2a97a0cf1965ea8f1d13b8973f22582",
              "versionType": "git"
            },
            {
              "lessThan": "15d1f3c0dbe7a740f779337deb39f23cd8d002c8",
              "status": "affected",
              "version": "b0d1beeff2a97a0cf1965ea8f1d13b8973f22582",
              "versionType": "git"
            },
            {
              "lessThan": "68d7cc5512238693670fc19c7a615df631e10edf",
              "status": "affected",
              "version": "b0d1beeff2a97a0cf1965ea8f1d13b8973f22582",
              "versionType": "git"
            },
            {
              "lessThan": "71283aaa6c65b3cec84caf1dc78560985737641f",
              "status": "affected",
              "version": "b0d1beeff2a97a0cf1965ea8f1d13b8973f22582",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/xdp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxdp: fix zero-copy frame layout\n\nxdp_convert_zc_to_xdp_frame() clones an XSK packet into an order-0 page\nand advertises PAGE_SIZE as its frame size.  It allows the copied frame\nto occupy the page tail needed by skb_shared_info and records zero\nheadroom even when metadata separates the frame header from packet data.\nAn AF_XDP zero-copy packet redirected through cpumap can therefore make\nthe skb overlap skb_shared_info or place it beyond the allocated page.\n\nLimit the copied layout to SKB_WITH_OVERHEAD(PAGE_SIZE) and include the\nmetadata length in frame headroom.  Redirect callers already handle a\nNULL conversion result.\n\nBUG: KASAN: slab-out-of-bounds in skb_gro_receive\nWrite of size 4 at addr ffff88800cf37004 by task cpumap/1/map:1/146\nCall Trace:\n skb_gro_receive (net/core/gro.c:174)\n udp_gro_receive (net/ipv4/udp_offload.c:812)\n inet_gro_receive (net/ipv4/af_inet.c:1539)\n dev_gro_receive (net/core/gro.c:515)\n gro_receive_skb (net/core/gro.c:633)\n cpu_map_kthread_run (kernel/bpf/cpumap.c:395)\n kthread (kernel/kthread.c:436)\n ret_from_fork (arch/x86/kernel/process.c:164)\n ret_from_fork_asm (arch/x86/entry/entry_64.S:255)\nKernel panic - not syncing: KASAN: panic_on_warn set ..."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Received AF_XDP zero-copy packets reach xdp_convert_zc_to_xdp_frame() on XDP_REDIRECT into cpumap or a veth. On an internet-facing NIC with that hybrid XDP/AF_XDP setup, unauthenticated remote frames drive the cloned page into skb/GRO; AF_XDP bind is a victim-side prerequisite, not a local-only syscall bug.\nAC:L - The sender chooses packet length, so a 4K UMEM/jumbo frame makes the clone occupy the skb_shared_info tail, and normal cpumap/veth metadata (bpf_xdp_adjust_meta) misplaces sinfo past the page. Either layout is attacker-reproducible with no race or uninfluenced memory-layout dependency.\nPR:N - The remote sender needs no account or capability. CAP_NET_RAW, CAP_NET_ADMIN, and CAP_BPF are required only by the victim process that binds the XSK queue and loads the XDP redirect program, matching other AF_XDP RX-path kernel scores.\nUI:N - After the interface is configured, inbound packets are converted and passed to GRO automatically in NAPI or the cpumap kthread; no victim mount, click, or other per-packet action is required.\nS:U - The out-of-bounds skb_shared_info write corrupts host kernel heap/page memory in the same kernel authority. It is ordinary kernel memory corruption, not a VM, IOMMU, or sandbox boundary crossing.\nC:H - skb_shared_info is placed past the order-0 page or overlapped with the copied frame, so GRO and build_skb write into adjacent objects that hold kernel pointers; that corruption can be turned into an arbitrary kernel read, so confidentiality is High.\nI:H - KASAN records a 4-byte out-of-bounds write in skb_gro_receive while building the skb around the mis-sized ZC clone. An OOB write of skb_shared_info (including pointer fields) is an arbitrary-write/control-flow primitive, so integrity is High.\nA:H - The same GRO path panics under KASAN and oopses without it when skb_shared_info is written off the allocated page, so a remote packet can crash the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T11:59:37.447Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dcb6db9ca6515fcd3e00c93ec5e27dc7a0a7012f"
        },
        {
          "url": "https://git.kernel.org/stable/c/22092730129077c302d8c947bbe0876f0280c528"
        },
        {
          "url": "https://git.kernel.org/stable/c/ced3e18cd9b9caf630aaa1e1eac305f5192ba896"
        },
        {
          "url": "https://git.kernel.org/stable/c/6de17275b3ccdf9887568b07e54da2e3597217cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/444216dacdbebd3e52d5e704facafbb230da09e9"
        },
        {
          "url": "https://git.kernel.org/stable/c/15d1f3c0dbe7a740f779337deb39f23cd8d002c8"
        },
        {
          "url": "https://git.kernel.org/stable/c/68d7cc5512238693670fc19c7a615df631e10edf"
        },
        {
          "url": "https://git.kernel.org/stable/c/71283aaa6c65b3cec84caf1dc78560985737641f"
        }
      ],
      "title": "xdp: fix zero-copy frame layout",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-81002",
    "datePublished": "2026-09-11T19:42:55.506Z",
    "dateReserved": "2026-08-26T14:34:25.812Z",
    "dateUpdated": "2026-09-14T11:59:37.447Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-81002",
      "date": "2026-09-22",
      "epss": "0.00521",
      "percentile": "0.43211"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-14T14:53:38.000Z",
      "cve": "CVE-2026-81002",
      "id": "msrc_CVE-2026-81002",
      "initial_release_date": "2026-09-13T01:07:07.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "xdp: fix zero-copy frame layout",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-81002.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/core/xdp.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "dcb6db9ca6515fcd3e00c93ec5e27dc7a0a7012f",
                    "status": "affected",
                    "version": "b0d1beeff2a97a0cf1965ea8f1d13b8973f22582",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "22092730129077c302d8c947bbe0876f0280c528",
                    "status": "affected",
                    "version": "b0d1beeff2a97a0cf1965ea8f1d13b8973f22582",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ced3e18cd9b9caf630aaa1e1eac305f5192ba896",
                    "status": "affected",
                    "version": "b0d1beeff2a97a0cf1965ea8f1d13b8973f22582",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6de17275b3ccdf9887568b07e54da2e3597217cf",
                    "status": "affected",
                    "version": "b0d1beeff2a97a0cf1965ea8f1d13b8973f22582",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "444216dacdbebd3e52d5e704facafbb230da09e9",
                    "status": "affected",
                    "version": "b0d1beeff2a97a0cf1965ea8f1d13b8973f22582",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "15d1f3c0dbe7a740f779337deb39f23cd8d002c8",
                    "status": "affected",
                    "version": "b0d1beeff2a97a0cf1965ea8f1d13b8973f22582",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "68d7cc5512238693670fc19c7a615df631e10edf",
                    "status": "affected",
                    "version": "b0d1beeff2a97a0cf1965ea8f1d13b8973f22582",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "71283aaa6c65b3cec84caf1dc78560985737641f",
                    "status": "affected",
                    "version": "b0d1beeff2a97a0cf1965ea8f1d13b8973f22582",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/core/xdp.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.20"
                  },
                  {
                    "lessThan": "4.20",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.270",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.221",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.109",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.50",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxdp: fix zero-copy frame layout\n\nxdp_convert_zc_to_xdp_frame() clones an XSK packet into an order-0 page\nand advertises PAGE_SIZE as its frame size.  It allows the copied frame\nto occupy the page tail needed by skb_shared_info and records zero\nheadroom even when metadata separates the frame header from packet data.\nAn AF_XDP zero-copy packet redirected through cpumap can therefore make\nthe skb overlap skb_shared_info or place it beyond the allocated page.\n\nLimit the copied layout to SKB_WITH_OVERHEAD(PAGE_SIZE) and include the\nmetadata length in frame headroom.  Redirect callers already handle a\nNULL conversion result.\n\nBUG: KASAN: slab-out-of-bounds in skb_gro_receive\nWrite of size 4 at addr ffff88800cf37004 by task cpumap/1/map:1/146\nCall Trace:\n skb_gro_receive (net/core/gro.c:174)\n udp_gro_receive (net/ipv4/udp_offload.c:812)\n inet_gro_receive (net/ipv4/af_inet.c:1539)\n dev_gro_receive (net/core/gro.c:515)\n gro_receive_skb (net/core/gro.c:633)\n cpu_map_kthread_run (kernel/bpf/cpumap.c:395)\n kthread (kernel/kthread.c:436)\n ret_from_fork (arch/x86/kernel/process.c:164)\n ret_from_fork_asm (arch/x86/entry/entry_64.S:255)\nKernel panic - not syncing: KASAN: panic_on_warn set ..."
          }
        ],
        "id": "CVE-2026-81002",
        "lastModified": "2026-09-14T13:18:54.553",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-11T20:19:08.483",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/15d1f3c0dbe7a740f779337deb39f23cd8d002c8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/22092730129077c302d8c947bbe0876f0280c528"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/444216dacdbebd3e52d5e704facafbb230da09e9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/68d7cc5512238693670fc19c7a615df631e10edf"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6de17275b3ccdf9887568b07e54da2e3597217cf"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/71283aaa6c65b3cec84caf1dc78560985737641f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ced3e18cd9b9caf630aaa1e1eac305f5192ba896"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/dcb6db9ca6515fcd3e00c93ec5e27dc7a0a7012f"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-14T20:35:54+00:00",
      "cve": "CVE-2026-81002",
      "id": "CVE-2026-81002",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "234",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: xdp: fix zero-copy frame layout",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-81002.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T00:06:07Z",
      "cve": "CVE-2026-81002",
      "id": "CVE-2026-81002",
      "initial_release_date": "2026-09-16T00:06:07Z",
      "product_status:known_affected": "349",
      "product_status:known_not_affected": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-81002",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-81002.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.