[SRU][Q][PATCH 0/1] CVE-2026-53216

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-53216

[ Impact ]

The mvpp2 driver uses short and long BM pools, where short pool buffers can be
smaller than PAGE_SIZE, but the XDP path initialized every xdp_buff with
PAGE_SIZE as the frame size. Since XDP helpers use frame_sz to validate tail
growth and derive the hard end of the data area, advertising PAGE_SIZE for
short buffers could let bpf_xdp_adjust_tail() grow a packet past the real
allocation. This can corrupt memory or later trip skb tailroom checks, leading
to potential system compromise.

[ Fix ]

questing: clean cherry-pick

[ Test Plan ]

Boot tested.

[ Where Problems Could Occur ]

A regression in this fix could affect XDP packet processing on Marvell mvpp2
network hardware, potentially causing incorrect frame size handling or dropped
packets on the RX path.