Executive brief
The Linux kernel's enetc network driver fails to properly clean up memory buffers when XDP packet redirection encounters an error. This can cause kernel memory pages to leak and accumulate over time, eventually exhausting available system memory and causing the system to become unresponsive or crash. Exploitation requires sending crafted network packets to trigger redirect failures.
Technical details
The vulnerability exists in the enetc_clean_rx_ring_xdp() function where page reference counting and buffer management is performed incorrectly after xdp_do_redirect() failures. The root cause is that rx_swbd->page pointers are zeroed before error handling completes, making it impossible to properly release the pages on redirect errors. When xdp_do_redirect() fails, the code calls enetc_xdp_free() which doesn't account for previously flipped buffers with elevated refcount values. The refcount remains at 2, preventing page reuse; on subsequent operations, the page is leaked entirely. The fix moves the page flip operation to occur only after successful redirect, and changes error handling to call enetc_xdp_drop() for buffer recycling instead of enetc_xdp_free(). This is a network-reachable denial of service requiring no authentication.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2025-10-04: disclosed