CVE Intelligence
Analysis AI-assisted

CVE-2026-53216: Linux Kernel mvpp2 Driver XDP Frame Size Validation Flaw

CVE-2026-53216 affects the mvpp2 network driver in the Linux kernel, where the XDP path advertises PAGE_SIZE as the frame size even when a short buffer pool is smaller. The record gives a CNA-assigned CVSS 3.1 score of 9.8 and lists seven stable-tree commits as fixes. The sources consulted show no confirmed exploitation.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-53216 is a kernel-side issue in the mvpp2 network driver of the Linux kernel. According to the record, the driver has short and long buffer manager pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as its frame size.

Impact

The record states that XDP helpers rely on frame_sz to validate tail growth and to find the hard end of the data area. Advertising a larger size than the real buffer can let bpf_xdp_adjust_tail() grow a packet past the actual allocation. The description says this could corrupt memory or later trigger skb tailroom checks.

  • The CNA-assigned CVSS 3.1 base score is 9.8, with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
  • The record marks the severity as critical.

Affected products and versions

The record lists the Linux Kernel as the affected product with these ranges:

  • Versions 5.9 up to, but not including, 5.15.210.
  • Versions 5.16 up to, but not including, 6.1.176.
  • Versions 6.2 up to, but not including, 6.6.143.
  • Versions 6.7 up to, but not including, 6.12.94.
  • Versions 6.13 up to, but not including, 6.18.36.
  • Versions 6.19 up to, but not including, 7.0.13.
  • Release candidates 7.1-rc1 through 7.1-rc7.

The upper bounds of these ranges suggest the branches where the fix is present, but the record does not state a fixed version for the release candidates. Seven stable-tree commits are listed in the NVD entry and the CVE Record, including this commit.

Exploitation status

The record shows that this CVE is not listed in CISA KEV. No confirmed active exploitation appears in the sources consulted, and the record provides no EPSS score. Exploitation status should be rechecked as new information becomes available.

Remediation and mitigation

  • Update Linux kernels to a stable release that includes the fix for your branch. Use the upper bounds of the affected ranges as a starting point for checking your version.
  • For systems on release candidates from the 7.1 series, track the upstream kernel for a fixed release, because the record does not name one.
  • If XDP programs are not required on mvpp2 interfaces, removing them reduces exposure. This is an inference from the description, not a vendor-stated workaround.
  • Review the kernel commit references to confirm which branches received the change in your distribution's kernel.

Detection guidance

  • Inventory systems that run the affected kernel ranges and identify which ones use the mvpp2 driver.
  • Review which network interfaces have XDP programs attached, and focus on mvpp2 interfaces.
  • Check kernel logs for unusual memory or networking errors on affected hosts. The record does not describe specific log messages, so treat this as a general measure.

Limitations of the available information

  • The record does not include a CWE classification, an EPSS score, or an SSVC assessment.
  • The record does not state a fixed version for the 7.1 release candidates.
  • The record does not map each listed commit to a specific stable branch.
  • The record does not describe exploit availability or the conditions needed for exploitation beyond the general mechanism.

Frequently asked questions

What is CVE-2026-53216?

It is a Linux kernel issue in the mvpp2 driver where XDP buffers advertise PAGE_SIZE as their frame size even when short pool buffers are smaller. The fix sets the XDP frame size to the real buffer size.

Is CVE-2026-53216 known to be actively exploited?

The record shows it is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.