Executive brief
The Linux kernel's XDP socket implementation contains a reference counting bug in the xsk subsystem that can occur during memory-constrained conditions. When the system runs out of memory and socket initialization fails, a reference count is not properly cleaned up, leading to a double-decrement when the socket is later closed. This can cause kernel memory corruption and system crashes.
Technical details
The vulnerability is a reference counting underflow in the XDP socket bind path (net/xdp/xsk.c). When xp_alloc_tx_descs() fails due to out-of-memory conditions, the error handler decrements the pool's refcount but fails to null the socket's pool pointer. Later, when the socket is destroyed, the teardown logic sees the dangling pool pointer and attempts another refcount decrement, causing an underflow. The fix is minimal: adding a single line (xs->pool = NULL) in the error path after xp_put_pool(). The vulnerability requires no special privileges or network access—it is triggered purely by local memory pressure during socket creation.
Affected products
- Linux Linux kernel 5.0 and later (XDP socket support)
Timeline
- 2023-08-09: disclosed: Patch submitted by Magnus Karlsson
- 2023-08-16: patched: Merged into stable kernel branches
- 2025-10-22: advisory