CVE-2026-23140

In the Linux kernel, the following vulnerability has been resolved:

bpf, testrun: Subtract size of xdpframe from allowed metadata size

The xdpframe structure takes up part of the XDP frame headroom, limiting the size of the metadata. However, in bpftest_run, we don't take this into account, which makes it possible for userspace to supply a metadata size that is too large (taking up the entire headroom).

If userspace supplies such a large metadata size in live packet mode, the xdpupdateframefrombuff() call in xdptestruninitpage() call will fail, after which packet transmission proceeds with an uninitialised frame structure, leading to the usual Bad Stuff.

The commit in the Fixes tag fixed a related bug where the second check in xdpupdateframefrombuff() could fail, but did not add any additional constraints on the metadata size. Complete the fix by adding an additional check on the metadata size. Reorder the checks slightly to make the logic clearer and add a comment.