Executive brief
A buffer management bug in the Linux kernel's mlx5 Ethernet driver can cause memory corruption when using AF_XDP (XSK) sockets with legacy receive queues. The driver incorrectly releases buffers twice, triggering a crash and potentially allowing an attacker with unprivileged network access to crash the system or execute code.
Technical details
The vulnerability is a double-free condition in the mlx5e XSK handler for legacy receive queues. When a buffer is processed via the XDP_REDIRECT path, it gets released once by the XDP subsystem; however, the driver was not properly setting the skip release flag, causing it to attempt release again on the driver side. This occurs because XSK buffer handling was refactored to use fragment reference counts instead of the legacy skip flag. The crash occurs in the BPF program execution path when accessing the already-freed buffer. The vulnerability requires unprivileged user access to create AF_XDP sockets and trigger the condition, making it remotely exploitable by a local attacker.
Affected products
- Linux Linux kernel before fix (approximately 6.5.0)
Timeline
- 2025-12-30: disclosed
- other: CVE-2023-54223 assigned