Executive brief
A vulnerability in the Linux kernel's high-performance networking component (AF_XDP) can cause the system to crash or experience data corruption. This occurs when the system processes network traffic, leading to a kernel panic that disrupts all operations on the affected machine. An attacker with local access could potentially exploit this to cause a complete denial of service.
Technical details
A vulnerability exists in the Linux kernel's AF_XDP (xsk) implementation where the descriptor number is stored in the skb control block (cb). Because the xsk subsystem loses control over the skb control block after transmission, other kernel subsystems may overwrite this data. This leads to a NULL pointer dereference in xsk_destruct_skb() or xsk_cq_submit_addr_locked() when the kernel attempts to process the completion queue. The fix involves moving the descriptor storage to the skb destructor_arg using pointer tagging to safely distinguish between single addresses and allocated structures. The issue was introduced in commit 30f241fcf52a and is resolved in versions 6.17.11 and 6.18.1.
Affected products
- Linux Linux 6.16.8 to 6.17.10
Timeline
- 2025-10-19: disclosed: Reported to Debian Bug Tracking System
- 2025-11-25: patched: Fix committed to Linux stable tree
- 2025-12-08: advisory: CVE-2025-40290 published