Linux ice driver: wrong XDP frag_size yields negative tailroom and a kernel panic

Impact

The ice driver populated xdp_rxq_info.frag_size with the DMA write length instead of the buffer truesize, which is what bpf_xdp_frags_increase_tail() expects. A multi-buffer XDP program that grows the tail can therefore compute negative tailroom and panic the kernel; the record reproduces it with the XDP_ADJUST_TAIL_GROW_MULTI_BUFF selftest at a 6912-byte packet size. Intel E810 NICs are common front-end and storage NICs on GPU nodes, so an XDP-based load balancer, firewall or observability program on a host can crash it outright and take the attached accelerators offline with it. In zero-copy mode the panic was not observed, but tail growth still fails when it should succeed.

Who can reach it

Local and privileged: requires the ability to load and attach a multi-buffer XDP program to an ice-driven interface (root or CAP_BPF/CAP_NET_ADMIN). Not reachable by an unprivileged tenant and not reachable at all on hosts with no XDP program attached to an ice interface.

What to do

Take the stable kernel fix that uses the fill-queue buffer truesize in XDP RxQ info (five stable commits linked in the record; no fixed release number is stated there). Applying it requires draining and rebooting the node. As an interim measure, detaching multi-buffer XDP programs from ice interfaces, or avoiding tail-growing helpers in them, removes the crash path.

References

Related entries

• Linux net/rds: allocation under the socket lock creates a reclaim deadlock pathCVE-2026-23419 · Linux kernel net/rds (rds_tcp_tune socket-lock ordering)Medium
• Linux i915 GPU kernel driver (submission backend setup): i915 dereferences the submission backend before checkingCVE-2026-31540 · Linux i915 GPU kernel driver (submission backend setup)Medium
• Linux kernel KVM SEV: userspace can trivially trigger a kernel WARN via an oversized encrypt-region ioctlCVE-2026-31590 · Linux kernel KVM SEV (sev_pin_memory WARN on KVM_MEMORY_ENCRYPT_REG_REGION)Medium
• Linux KVM/SEV: unlocked sev_guest() check lets a local user crash the host kernelCVE-2026-31592 · Linux kernel KVM SEV (sev_mem_enc_register_region)Medium
• Linux kernel: AMD Zen1 divider leaks partial results across SMT threads until the FPDSS bit is setCVE-2026-31628 · Linux kernel x86/CPU (AMD Zen1 FPDSS divider chicken bit)Medium
• Linux kernel AF_ALG: receive-side scatterlist extraction ignored the receive buffer budgetCVE-2026-31677 · Linux kernel crypto AF_ALG (af_alg_get_rsgl receive buffer accounting)Medium