{"id":"CVE-2026-99127","kind":"vulnerability","aliases":["CVE-2026-99127"],"related":[],"title":"Linux kernel: page_pool misalignment can panic x86 via split lock","description":"In the Linux kernel, the following vulnerability has been resolved:\n\npage_pool: keep frag_offset aligned for odd-sized requests\n\npage_pool_alloc_frag_netmem() rounds the requested fragment size with\n\n\tsize = ALIGN(size, dma_get_cache_alignment());\n\ndma_get_cache_alignment() returns 1 unless the architecture defines\nARCH_DMA_MINALIGN, which DMA-coherent architectures such as x86 do not.\nThere the ALIGN() is a no-op and pool->frag_offset advances by the raw,\nunrounded size.\n\nA single caller asking for an odd size then leaves frag_offset misaligned\nfor every fragment carved out of that page afterwards.  The pool is shared,\nso the damage is not confined to the caller that caused it.\n\nThe per-cpu system_page_pool used by generic XDP hits this.\nskb_pp_cow_data() allocates its fragments with the raw packet length:\n\n\tsize = min_t(u32, len, PAGE_SIZE);\n\ttruesize = size;\n\tpage = page_pool_dev_alloc(pool, &page_off, &truesize);\n\nleaving frag_offset odd for whatever is carved out of that page next.  Its\nown head allocation is already aligned -- SKB_HEAD_ALIGN(size) plus the\nXDP_PACKET_HEADROOM its callers pass -- so it is a later user of the shared\npool that pays: page_pool_dev_alloc_va() returns a misaligned buffer,\nnapi_build_skb() installs it as skb->head, and skb_shinfo(skb) ==\nskb->head + skb->end is misaligned with it.\n\nskb_shinfo()->dataref is a 4-byte atomic_t at offset 0x20, so the\natomic_inc() in __skb_clone() straddles a cache line.  On x86 with split\nlock detection -- fatal for kernel split locks by default -- this panics\nthe machine:\n\n  Oops: Split lock detected\n  RIP: 0010:skb_clone+0x154/0x1e0\n  Call Trace:\n   <IRQ>\n   raw_local_deliver+0x1ed/0x2c0\n   ip_protocol_deliver_rcu+0x54/0x1c0\n   ip_local_deliver_finish+0x85/0x100\n   ip_local_deliver+0x67/0x100\n   __netif_receive_skb_one_core+0x85/0xa0\n   process_backlog+0x87/0x130\n\nReproduced by attaching any generic-mode XDP program to loopback and\nopening a RAW IPPROTO_UDP socket, which makes raw_local_deliver() clone\nevery locally delivered UDP packet; ordinary DNS traffic then triggers it,\nroughly once per 2500 clones.  Observed on 6.12.101 and 7.1.8.\n\nTracing page_pool_alloc_frag_netmem() over one such run shows the\namplification -- two odd-sized requests, nine misaligned offsets:\n\n  requested size & 7:   0: 17035    5: 1    7: 1\n  frag_offset & 7:      0: 17028    3: 1    4: 1    5: 1    6: 1    7: 5\n\nand skb_pp_cow_data() returning heads that were aligned on entry:\n\n  head 0xffff8f4c86aeac00 -> 0xffff8f4c53a9a9c4 (&7=4)\n  head 0xffff8f4d6a8a42c0 -> 0xffff8f4c4f7b7a45 (&7=5)\n\nRound the fragment size up to at least the alignment struct skb_shared_info\nrequires, so fragments are always suitably aligned for the objects callers\nbuild on them.  Architectures needing a larger DMA alignment keep it.\n\nThis also makes the remainder computed in page_pool_alloc_netmem(),\n\n\t*size = max_size - *offset;\n\naligned, since max_size is a power of two -- which fixes the matching\nmisalignment of skb->end.\n\nVerified with a controlled A/B under QEMU/KVM: same tree, same config,\nsame compiler, same rootfs and identical traffic, differing only by this\npatch.  A SEC(\"xdp.frags\") XDP_PASS program on lo plus UDP datagrams\nlarger than max_head_size drives skb_pp_cow_data()'s fragment loop, which\npasses raw packet lengths to the pool.  Measured at the return of\nskb_pp_cow_data():\n\n                          unpatched   patched\n  skb_pp_cow_data calls       40800     40800\n  misaligned skb->head         1120         0\n  dataref at line offset >60     80         0\n\nThe last row counts the accesses that actually fault:\nskb_shinfo()->dataref sits at head+end+0x20 and is a 4-byte atomic, so\n`lock incl` splits a 64-byte cache line only when that address lands at\noffset 61..63.  All 80 occurrences were at offset 61; the panic reported\nabove was at offset 62.  Eliminating the misalignment removes every one\nof them.\n\nSame class of bug as commit 3bed3cc4156e (\"net: Do not allocate page\nfragments t\n---truncated---","summary":"Odd-sized page_pool fragment requests leave later fragments misaligned, so a skb_shared_info atomic straddles a cache line. On x86 with split lock detection, a generic-mode XDP setup on loopback with raw UDP sockets can crash the machine with a kernel Oops.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kernel","linux","package","x86","xdp"],"not_affected_if":["no-generic-xdp","no-raw-udp-sockets"],"how_to_check":"- Check the running kernel with `uname -r` and compare against the fixed versions listed in the kernel git commit or NVD entry\n- Unknown whether the sources list specific affected kernel ranges beyond 6.12.101 and 7.1.8 as observed","fix":"- Update the Linux kernel to a release that includes the upstream page_pool fix for CVE-2026-99127 (exact version unknown from sources)","status":"open","published_at":"2026-10-28T11:17:32+00:00","first_seen_at":"2026-10-28T11:32:35+00:00","triaged_at":"2026-10-28T11:36:20+00:00","updated_at":"2026-10-28T11:36:20+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T11:36:20Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream page_pool fix for CVE-2026-99127 (exact version unknown from sources)","reach":"network","title":"Linux kernel: page_pool misalignment can panic x86 via split lock","impact":"medium","summary":"Odd-sized page_pool fragment requests leave later fragments misaligned, so a skb_shared_info atomic straddles a cache line. On x86 with split lock detection, a generic-mode XDP setup on loopback with raw UDP sockets can crash the machine with a kernel Oops.","category":"package","nicknames":[],"who_cares":["linux","x86","xdp","kernel"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote network traffic can panic the kernel, causing denial of service","analyst_note":"Fixed kernel versions and exact affected ranges are not in the sources; check the NVD entry and kernel stable commit for the fixing version.","how_to_check":"- Check the running kernel with `uname -r` and compare against the fixed versions listed in the kernel git commit or NVD entry\n- Unknown whether the sources list specific affected kernel ranges beyond 6.12.101 and 7.1.8 as observed","needs_analyst":true,"not_affected_if":["no-generic-xdp","no-raw-udp-sockets"],"who_is_affected":"Systems running the Linux kernel on x86 with split lock detection enabled (default for kernel split locks) that use generic-mode XDP (for example on loopback) and have raw IPPROTO_UDP sockets receiving locally delivered traffic. Architectures that define ARCH_DMA_MINALIGN are not described as affected by the same mechanism. Hosts without generic XDP or without such raw sockets are not described as exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000819,"input_tokens":4928,"output_tokens":653,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':352C,359C,365C,371C,376C,383C,387C,670C '-2026':13A,16A '-99127':14A,17A '0':458C,467C,646C,653C '0010':349C '0x20':315C '0xffff8f4c4f7b7a45':498C '0xffff8f4c53a9a9c4':493C '0xffff8f4c86aeac00':492C '0xffff8f4d6a8a42c0':497C '1':114C,461C,463C,470C,472C,474C,476C '1120':645C '17028':468C '17035':459C '2500':427C '3':469C '3bed3cc4156e':725C '4':309C,471C,495C,675C '40800':640C,641C '5':460C,473C,478C,500C '6':475C '6.12.101':431C '60':651C '61':694C,702C '62':710C '63':695C '64':683C '7':457C,462C,466C,477C,494C,499C '7.1.8':433C '80':652C,697C 'a/b':573C 'access':659C 'actual':661C 'address':690C 'advanc':144C 'afterward':171C 'align':85C,103C,108C,112C,134C,250C,253C,488C,510C,521C,534C,552C 'alloc':93C,205C,226C,247C,278C,437C,546C,729C 'alreadi':249C 'also':538C 'alway':519C 'amplif':446C 'arch':119C 'architectur':117C,126C,529C 'ask':153C 'atom':39B,311C,318C,677C 'attach':391C 'backlog':386C 'buffer':283C 'bug':722C 'build':285C,526C 'byte':310C,676C,684C 'cach':42B,107C,111C,325C,685C 'call':354C,639C 'caller':152C,184C,261C,525C 'carv':166C,238C 'caus':186C 'class':720C 'clone':322C,351C,412C,428C 'coher':125C 'commit':724C 'compil':581C 'comput':542C 'config':579C 'confin':181C 'control':572C 'core':382C 'count':657C 'cow':203C,482C,611C,631C,637C 'cpu':191C 'crash':63B 'cve':12A,15A 'damag':178C 'data':204C,483C,612C,632C,638C 'datagram':602C 'dataref':306C,647C,665C 'default':339C 'defin':118C 'deliv':358C,363C,369C,375C,411C,415C 'detect':49B,332C,347C 'dev':225C,277C 'differ':587C 'dma':105C,109C,120C,124C,533C 'dma-coher':123C 'dns':419C 'drive':608C 'elimin':711C 'end':299C,568C,669C 'entri':490C 'everi':164C,413C,715C 'fatal':333C 'fault':662C 'finish':370C 'fix':562C 'follow':75C 'frag':83C,94C,142C,160C,232C,438C,464C 'fragment':28B,32B,99C,165C,207C,503C,517C,614C,731C 'generic':52B,197C,394C 'generic-mod':51B,393C 'get':106C,110C 'head':246C,252C,291C,297C,485C,491C,496C,606C,644C,668C 'headroom':259C 'hit':199C 'ident':585C 'inc':319C 'incl':680C 'info':38B,514C 'instal':287C 'ip':361C,367C,373C 'ipproto':404C 'keep':82C,535C 'kernel':2A,18B,68B,73C,335C 'land':691C 'larger':532C,603C 'last':655C 'later':31B,267C 'least':508C 'leav':30B,159C,231C 'len':217C 'length':212C,620C 'line':43B,326C,649C,686C 'linux':1A,19B,72C 'lo':599C 'local':357C,368C,374C,410C,414C 'lock':11A,48B,331C,337C,346C,679C 'loop':615C 'loopback':57B,399C 'machin':65B,343C 'make':408C,539C 'match':564C 'max':549C,554C,605C 'measur':624C 'min':214C 'minalign':121C 'misalign':5A,33B,162C,282C,301C,453C,565C,642C,713C 'mode':53B,395C 'napi':284C 'need':530C 'net':726C 'netif':378C 'netmem':95C,439C,547C 'next':243C 'nine':452C 'no-op':137C 'object':524C 'observ':429C 'occurr':698C 'odd':24B,88C,156C,234C,449C 'odd-siz':23B,87C,448C 'offset':84C,143C,161C,233C,314C,454C,465C,551C,650C,693C,701C,709C 'one':381C,441C,716C 'oop':69B,344C 'op':139C 'open':401C 'ordinari':418C 'packag':20B 'packet':211C,258C,417C,619C 'page':3A,26B,80C,91C,170C,193C,218C,222C,223C,228C,242C,275C,435C,544C,730C 'panic':7A,341C,704C 'pass':262C,596C,617C 'patch':591C,634C 'pay':274C 'per':190C,426C 'per-cpu':189C 'plus':255C,600C 'pool':4A,27B,81C,92C,141C,173C,194C,224C,227C,272C,276C,436C,545C,623C 'power':558C 'pp':202C,481C,610C,630C,636C 'process':385C 'program':397C,597C 'protocol':362C 'qemu/kvm':575C 'raw':59B,147C,210C,356C,403C,409C,618C 'rcu':364C 'receiv':379C 'remaind':541C 'remov':714C 'report':705C 'reproduc':389C 'request':29B,90C,98C,451C,455C 'requir':515C 'resolv':79C 'return':113C,280C,484C,627C 'rip':348C 'rootf':583C 'rough':424C 'round':96C,501C 'row':656C 'run':443C 'sec':593C 'setup':55B 'share':37B,175C,271C,513C 'shinfo':294C,305C,664C 'show':444C 'sinc':553C 'singl':151C 'sit':666C 'size':25B,89C,100C,102C,104C,149C,157C,213C,219C,221C,254C,450C,456C,504C,548C,550C,555C,607C 'skb':36B,201C,251C,286C,290C,293C,295C,296C,298C,304C,321C,350C,380C,480C,512C,567C,609C,629C,635C,643C,663C 'socket':61B,406C 'split':10A,47B,330C,336C,345C,681C 'straddl':40B,323C 'struct':511C 'suitabl':520C 'system':192C 'trace':355C,434C 'traffic':420C,586C 'tree':577C 'trigger':422C 'truesiz':220C,230C 'truncat':733C 'two':447C,560C 'u32':216C 'udp':60B,405C,416C,601C 'unless':115C 'unpatch':633C 'unround':148C 'use':195C 'user':268C 'va':279C 'verifi':569C 'via':9A 'vulner':76C 'whatev':236C 'x154/0x1e0':353C 'x1ed/0x2c0':360C 'x20':671C 'x54/0x1c0':366C 'x67/0x100':377C 'x85/0x100':372C 'x85/0xa0':384C 'x86':8A,21B,45B,129C,328C 'x87/0x130':388C 'xdp':22B,54B,198C,257C,396C,595C 'xdp.frags':594C","nicknames":[],"mitigations":[],"who_affected":"Systems running the Linux kernel on x86 with split lock detection enabled (default for kernel split locks) that use generic-mode XDP (for example on loopback) and have raw IPPROTO_UDP sockets receiving locally delivered traffic. Architectures that define ARCH_DMA_MINALIGN are not described as affected by the same mechanism. Hosts without generic XDP or without such raw sockets are not described as exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99127","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99127","severity":null,"published_at":"2026-10-28T11:17:32+00:00","modified_at":"2026-10-28T11:17:32+00:00","first_seen_at":"2026-10-28T11:32:35+00:00","fetched_at":"2026-10-28T11:32:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}