APPLIED[N:hwe-6.17]: [SRU][Q][PATCH 0/1] CVE-2026-53216

[Edoardo Canepa]

Applied to n:linux/hwe-6.17-next. Thanks.

On 7/17/26 07:20, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-53216
>
> [ Impact ]
>
> The mvpp2 driver uses short and long BM pools, where short pool buffers can be
> smaller than PAGE_SIZE, but the XDP path initialized every xdp_buff with
> PAGE_SIZE as the frame size. Since XDP helpers use frame_sz to validate tail
> growth and derive the hard end of the data area, advertising PAGE_SIZE for
> short buffers could let bpf_xdp_adjust_tail() grow a packet past the real
> allocation. This can corrupt memory or later trip skb tailroom checks, leading
> to potential system compromise.
>
> [ Fix ]
>
> questing: clean cherry-pick
>
> [ Test Plan ]
>
> Boot tested.
>
> [ Where Problems Could Occur ]
>
> A regression in this fix could affect XDP packet processing on Marvell mvpp2
> network hardware, potentially causing incorrect frame size handling or dropped
> packets on the RX path.
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260730/d7b626eb/attachment-0001.sig>