Executive brief
The Linux kernel's AF_XDP socket implementation has a resource handling bug in its multi-buffer transmit path. When sending large packets or encountering invalid descriptors, the kernel silently discards buffer descriptors instead of properly returning them to the completion queue, causing a resource leak that prevents applications from ever reclaiming those buffers.
Technical details
The vulnerability exists in the xsk_build_skb() function within the generic transmit path for AF_XDP sockets. When a multi-buffer packet exceeds the kernel's SKB_FRAGS limit or contains an invalid descriptor, the function returns an -EOVERFLOW error but fails to drain continuation descriptors from the transmit ring, causing them to be lost permanently. The fix introduces a drain_cont flag and an xsk_cq_submit_addr_single_locked() helper function to ensure that overflow descriptors are consumed and submitted to the completion queue, allowing userspace to recover them. This is a resource handling issue rather than a memory corruption vulnerability, affecting AF_XDP performance and reliability under specific packet fragmentation scenarios.
Affected products
- Linux Linux Kernel 5.18 and later (approximately), fixed in upstream and stable branches
Timeline
- 2026-04-25: other: Vulnerability reported via kernel mailing list
- 2026-07-19: patched: Patch committed upstream (commit bd44a6dcd4248883de90f5dad53ae80066e27096)
- 2026-08-09: patched: Patch merged into stable kernel branches
- 2026-08-15: disclosed: CVE-2026-74559 published