CVE-2026-53216: net: mvpp2: limit XDP frame size to the RX buffer

Synopsis

A memory corruption vulnerability exists in the Linux kernel's mvpp2 network driver, reachable over the network without any authentication. The driver incorrectly advertises PAGE_SIZE as the XDP frame size for short buffer-pool allocations, allowing the bpf_xdp_adjust_tail() helper to grow a packet past the real allocation boundary, corrupting kernel memory. Successful exploitation gives an attacker the ability to read arbitrary kernel memory, tamper with kernel data structures, or crash the system. A patched-image rebuild at the fix versions (5.15.210, 6.1.176, 6.6.143, and the upstream commit) is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable code path is reachable over the network; an attacker must be able to send packets to a host running an affected mvpp2 network interface.

• AuthenticationNot required

  No account or credential of any privilege level is needed to trigger the vulnerability; unauthenticated network traffic is sufficient.

• Victim interactionNot required

  No user or administrator action is required; the vulnerability is triggered by incoming network packets processed by the driver.

• Attack complexityDetail

  Exploitation is reliable and imposes no special environmental conditions; the attacker does not need to win a race or arrange a specific memory layout to reach the vulnerable code path.

Blast Radius

• An attacker can corrupt out-of-bounds kernel memory beyond a short BM pool buffer, potentially overwriting adjacent kernel data structures.
• An attacker can read contents of kernel memory regions adjacent to the short pool allocation, exposing sensitive in-kernel data such as pointers, keys, or session state.
• An attacker can modify persisted kernel data structures, altering network stack behavior or privilege-enforcement state.
• An attacker can crash the affected kernel entirely by tripping skb tailroom checks or causing a fault from the corrupted memory region, taking down all workloads on the host.