Executive brief
The ixgbe network driver in the Linux kernel contains a logic error that causes the system to panic when running XDP programs on systems with more than 64 CPU cores. The vulnerability allows the kernel to attempt out-of-bounds array access, leading to a denial of service that crashes the entire system or causes it to become unresponsive.
Technical details
The vulnerability is an array-index-out-of-bounds condition in ixgbe_determine_xdp_ring() that occurs when XDP_TX programs run on systems with more than 64 CPUs. The driver uses a modulo operation (cpu % IXGBE_MAX_XDP_QS where IXGBE_MAX_XDP_QS=64) to index XDP TX rings, but the ixgbe_xdp_locking_key flag that enables this logic is incorrectly decremented during ring reconfiguration (via ixgbe_setup_tc or ethtool --set-channels), causing the array indexing to use unmodulated CPU IDs (e.g., CPU 65) and trigger out-of-bounds access. The attack vector is local and requires either loading an XDP program or using ethtool to reconfigure network channels. The fix relocates ixgbe_xdp_locking_key initialization into the probe path to prevent premature decrement during ring reconfigurations.
Affected products
- Linux Linux Kernel 5.15.0 and later through 6.x (ixgbe driver)
Timeline
- 2025-12-24: disclosed