ACK: [SRU][Q][PATCH 0/1] CVE-2026-53216

[Tim Whisonant]

On Fri, Jul 17, 2026 at 08:20:47AM +0300, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-53216
> 
> [ Impact ]
> 
> The mvpp2 driver uses short and long BM pools, where short pool buffers can be
> smaller than PAGE_SIZE, but the XDP path initialized every xdp_buff with
> PAGE_SIZE as the frame size. Since XDP helpers use frame_sz to validate tail
> growth and derive the hard end of the data area, advertising PAGE_SIZE for
> short buffers could let bpf_xdp_adjust_tail() grow a packet past the real
> allocation. This can corrupt memory or later trip skb tailroom checks, leading
> to potential system compromise.
> 
> [ Fix ]
> 
> questing: clean cherry-pick
> 
> [ Test Plan ]
> 
> Boot tested.
> 
> [ Where Problems Could Occur ]
> 
> A regression in this fix could affect XDP packet processing on Marvell mvpp2
> network hardware, potentially causing incorrect frame size handling or dropped
> packets on the RX path.
> 

Acked-by: Tim Whisonant <tim.whisonant at canonical.com>