Answer in brief
CVE-2026-64355 records a Unknown severity vulnerability in bpf: Reject fragmented frames in devmap. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=e624d4ed4aa8cc3c69d1359b0aaea539203ed266 <47baddc856ae7e93a565dd9deeb797999b179466 || >=e624d4ed4aa8cc3c69d1359b0aaea539203ed266 <07a4c11ee8ef4abcb39d922e9e410ae269671cdf || >=e624d4ed4aa8cc3c69d1359b0aaea539203ed266 <bccbab36ff228e0825eb85d9b0f9b8434cd0a399 || >=e624d4ed4aa8cc3c69d1359b0aaea539203ed266 <c5b4f5efcb55c1af3fe44ff712d31b7fb098a831 || >=e624d4ed4aa8cc3c69d1359b0aaea539203ed266 <a9bb2d9c798cb62a4050a991c27b752770c33afe || >=e624d4ed4aa8cc3c69d1359b0aaea539203ed266 <51d07c12ca411e692c424ecdabf077f1e61a61be || >=e624d4ed4aa8cc3c69d1359b0aaea539203ed266 <aa496720618f1a6054f1c870bf10b4f6c99bf656 | 47baddc856ae7e93a565dd9deeb797999b179466, 07a4c11ee8ef4abcb39d922e9e410ae269671cdf, bccbab36ff228e0825eb85d9b0f9b8434cd0a399, c5b4f5efcb55c1af3fe44ff712d31b7fb098a831, a9bb2d9c798cb62a4050a991c27b752770c33afe, 51d07c12ca411e692c424ecdabf077f1e61a61be, aa496720618f1a6054f1c870bf10b4f6c99bf656 |
| Linux/Linuxgeneric | 5.14 | Not reported |
Published upstream
Jul 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject fragmented frames in devmap Devmap broadcast redirects clone the packet for all but the last destination. For native XDP, that clone path copies only the linear xdp_frame data, while fragmented frames keep skb_shared_info in tailroom outside the linear area. Cloning such a frame leaves XDP_FLAGS_HAS_FRAGS set but without valid frag metadata, and the later free path can interpret uninitialized tail data as skb_shared_info, leading to an out-of-bounds access during frame return. Reject fragmented native XDP frames in dev_map_enqueue_clone(). Add the same restriction to the generic XDP clone path in dev_map_redirect_clone(). Generic XDP represents fragmented packets as nonlinear skbs, and rejecting them here keeps clone-based broadcast support aligned between native and generic XDP.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-64355 records a Unknown severity vulnerability in bpf: Reject fragmented frames in devmap. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=e624d4ed4aa8cc3c69d1359b0aaea539203ed266 <47baddc856ae7e93a565dd9deeb797999b179466 || >=e624d4ed4aa8cc3c69d1359b0aaea539203ed266 <07a4c11ee8ef4abcb39d922e9e410ae269671cdf || >=e624d4ed4aa8cc3c69d1359b0aaea539203ed266 <bccbab36ff228e0825eb85d9b0f9b8434cd0a399 || >=e624d4ed4aa8cc3c69d1359b0aaea539203ed266 <c5b4f5efcb55c1af3fe44ff712d31b7fb098a831 || >=e624d4ed4aa8cc3c69d1359b0aaea539203ed266 <a9bb2d9c798cb62a4050a991c27b752770c33afe || >=e624d4ed4aa8cc3c69d1359b0aaea539203ed266 <51d07c12ca411e692c424ecdabf077f1e61a61be || >=e624d4ed4aa8cc3c69d1359b0aaea539203ed266 <aa496720618f1a6054f1c870bf10b4f6c99bf656 | 47baddc856ae7e93a565dd9deeb797999b179466, 07a4c11ee8ef4abcb39d922e9e410ae269671cdf, bccbab36ff228e0825eb85d9b0f9b8434cd0a399, c5b4f5efcb55c1af3fe44ff712d31b7fb098a831, a9bb2d9c798cb62a4050a991c27b752770c33afe, 51d07c12ca411e692c424ecdabf077f1e61a61be, aa496720618f1a6054f1c870bf10b4f6c99bf656 |
| Linux/Linuxgeneric | 5.14 | Not reported |
Published upstream
Jul 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject fragmented frames in devmap Devmap broadcast redirects clone the packet for all but the last destination. For native XDP, that clone path copies only the linear xdp_frame data, while fragmented frames keep skb_shared_info in tailroom outside the linear area. Cloning such a frame leaves XDP_FLAGS_HAS_FRAGS set but without valid frag metadata, and the later free path can interpret uninitialized tail data as skb_shared_info, leading to an out-of-bounds access during frame return. Reject fragmented native XDP frames in dev_map_enqueue_clone(). Add the same restriction to the generic XDP clone path in dev_map_redirect_clone(). Generic XDP represents fragmented packets as nonlinear skbs, and rejecting them here keeps clone-based broadcast support aligned between native and generic XDP.
Quoted source text, attributed separately from HOL analysis.