SB20261029189 - Reliance on Data/Memory Layout in Linux kernel core

Description

This security bulletin contains information about 1 vulnerability.

1) Reliance on Data/Memory Layout (CVE-ID: CVE-2026-99127)

CWE-ID: CWE-188 - Reliance on Data/Memory Layout

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service through a kernel panic.

The vulnerability exists due to insufficient fragment alignment in page_pool_alloc_frag_netmem() when processing odd-sized allocation requests on architectures where DMA cache alignment does not ensure socket buffer alignment. A local privileged user can trigger odd-sized packet fragment allocations through generic XDP processing to leave subsequent allocations from the shared page pool misaligned, causing atomic operations during socket buffer cloning to cross cache-line boundaries and panic the kernel on x86 systems with fatal split-lock detection enabled.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/813a72beaa5d3f4bb135e0def9b3f07a3511ca0e
• https://git.kernel.org/stable/c/dc0df5a0c62ccea1d0e08d39a4dc9064de81d411
• https://git.kernel.org/stable/c/dca1b51693c81eaf77e50980be373e01ae857394