{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-53216",
  "modified": "2026-10-07T17:22:01Z",
  "upstream": [
    "CVE-2026-53216"
  ],
  "published": "2026-06-25T08:41:40Z",
  "summary": "net: mvpp2: limit XDP frame size to the RX buffer",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mvpp2: limit XDP frame size to the RX buffer\n\nmvpp2 has short and long BM pools, and short pool buffers can be smaller\nthan PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with\nPAGE_SIZE as frame size.\n\nXDP helpers use frame_sz to validate tail growth and to derive the hard\nend of the data area. Advertising PAGE_SIZE for short buffers can let\nbpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting\nmemory or later tripping skb tailroom checks.\n\nInitialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches\nthe actual buffer backing the packet.",
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.176",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53216"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/a3ee9231ccec6ec3be2de89c56f897055fd9eab1"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/ec8e1e5842bc0dbd4c272761f4db3651eecd0339"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/3b8b0c3631b19faee53f0d15a49924129b063eec"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/994bd2b58d2bd08aa97ec0836cc813cfcb00d749"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/910617a4e67dbdd5fdb39d9dc6a51e491e1b2c3e"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/9545cc5ef18ca22d031f2f47c157192460652359"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/f3c6aa078927e6fe8121c9c591ddee8716c5305a"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T13:16:28Z"
  }
}