Executive brief
The Linux kernel's BPF cpumap feature, used to redirect network packets in XDP (eXpress Data Path) programs, has a race condition where worker threads can be stopped prematurely before processing queued packets. This can cause system warnings, memory corruption, or data loss when XDP packet redirection is active under certain conditions.
Technical details
A race condition exists in kernel/bpf/cpumap.c where kthread_stop() terminates the per-CPU kernel thread before it begins execution in cpu_map_kthread_run(), despite the XDP program having already queued frames or skbs into the ring buffer. This leaves pending packets unprocessed, triggering a warning in __cpu_map_ring_cleanup(). The vulnerability occurs in the map update path (__cpu_map_entry_alloc()) which returns before confirming the kthread is actually running. The fix ensures the per-CPU kthread is confirmed running before the map update returns, preventing premature termination and ensuring all queued packets are properly handled.
Affected products
- Linux Linux kernel 5.x through 6.5.0-rc2
Timeline
- 2025-10-04: disclosed