Executive brief
A security vulnerability has been identified in the Linux kernel's high-performance networking component (AF_XDP). This component is used by applications to process network packets at very high speeds. An attacker with local access to the system could provide specially crafted data to the kernel, potentially causing the system to crash or allowing unauthorized access to sensitive information. This issue has been resolved in recent kernel updates.
Technical details
An integer overflow vulnerability exists in the AF_XDP (XSK) subsystem of the Linux kernel within the xp_aligned_validate_desc() and xp_unaligned_validate_desc() functions. When userspace provides an xdp_desc with a length close to U32_MAX or a very low address combined with a non-zero tx_metadata_len, the validation logic can suffer from positive or negative integer overflows. This allows invalid descriptors to pass safety checks, potentially leading to out-of-bounds memory access or undefined behavior during packet transmission. The fix involves promoting length variables to 64-bit integers and using explicit overflow-checked arithmetic (check_add_overflow and check_sub_overflow). The vulnerability affects kernels from version 6.8 onwards where TX metadata support was introduced.
Affected products
- Linux Linux Kernel 6.8 to 6.12.53, 6.17.3
Timeline
- 2025-10-08: other: Patch authored
- 2025-11-12: disclosed: CVE published