Executive brief
The Linux kernel's AF_XDP (Address Family XDP) socket implementation contains a buffer leak in the xsk_drop_skb() function when handling multi-buffer packet transmission. When a multi-buffer packet is dropped—such as when it exceeds size limits, contains invalid descriptors, or the socket closes—allocated buffer addresses are not properly returned to userspace, causing permanent buffer loss and potential denial of service through resource exhaustion.
Technical details
The vulnerability is a resource leak in the AF_XDP socket layer's xsk_drop_skb() function. When a multi-buffer skb (socket buffer) is discarded during TX operations, the function incorrectly cancels completion queue (CQ) reservations via xsk_cq_cancel_locked() instead of properly submitting buffer addresses back to the CQ through xsk_destruct_skb(). This occurs in three scenarios: when a packet exceeds MAX_SKB_FRAGS, when an invalid descriptor prevents packet completion, or when the socket closes with an incomplete packet. The fix involves allowing consume_skb() to trigger the xsk_destruct_skb destructor to properly submit addresses to the CQ, and moving the descriptor address assignment above the overflow check in xsk_build_skb() to ensure consistent handling.
Affected products
- Linux Linux Kernel multiple versions (prior to fix)
Timeline
- 2026-08-15: disclosed
- patched: patch provided in advisory