CVE-2026-23377: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23377 is a buffer size miscalculation vulnerability in the Linux kernel's ice driver XDP (Express Data Path) receive queue implementation. The frag_size field in XDP RxQ info is incorrectly set to the DMA write length rather than the actual XDP frame size (xdp.frame_sz), causing negative tailroom calculations that can trigger a kernel panic. Affected versions include Linux kernel 6.3 through 6.19.6 and 7.0-rc1 through 7.0-rc2. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla). The vulnerability was published on March 25, 2026, and patches were made available in kernel versions 6.19.7 and 7.0-rc3.

The root cause is an incorrect calculation of buffer size (CWE-131) in the ice driver's XDP receive queue configuration. The frag_size field in XDP RxQ info is populated with the DMA write length rather than the full frame size expected by bpf_xdp_frags_increase_tail(), the sole consumer of this field. This mismatch causes the tailroom calculation to go negative when XDP_ADJUST_TAIL operations attempt to grow multi-buffer packet tails. The issue can be triggered locally by crafting XDP packet operations using the XDP_ADJUST_TAIL_GROW_MULTI_BUFF test with a packet size of 6912 bytes and a large offset value (e.g., XSK_UMEM__MAX_FRAME_SIZE * 100). The fix replaces the DMA write size with the fill queue buffer truesize in XDP RxQ info, and applies a corresponding correction to Zero-Copy (ZC) mode via a new helper (Red Hat Bugzilla, Kernel Patch 1, Kernel Patch 2).

Successful exploitation allows a local attacker with low privileges to trigger a kernel panic, resulting in a complete denial of service (system crash). The vulnerability has no confidentiality or integrity impact — only availability is affected. In ZC (Zero-Copy) mode, a kernel panic is not directly observed due to driver quirks, but tailroom growth operations still fail incorrectly, potentially disrupting XDP-based network processing workloads (Red Hat Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.018% (0.000180), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges and knowledge of XDP packet crafting techniques (Red Hat Advisory).

Update the Linux kernel to version 6.19.7 or later, or to 7.0-rc3 or later, which include the fixes in commits b0f05100e8795aadd1c0606bae9caefbda070d63 and e142dc4ef0f451b7ef99d09aaa84e9389af629d7. If immediate patching is not feasible, restrict local system access and limit XDP packet processing operations to trusted users only. Distributions such as Red Hat should be monitored for downstream kernel package updates addressing this CVE (Red Hat Bugzilla, Kernel Patch 1, Kernel Patch 2).