Executive brief
The Linux kernel's XDP socket implementation did not properly validate the size of launch-time metadata structures before use, allowing a malicious or careless application to trigger buffer overflows or memory access violations. This could cause a kernel crash, information disclosure, or local privilege escalation on systems using XDP sockets for packet processing.
Technical details
The vulnerability exists in the XDP socket (AF_XDP) transmit metadata handling code, specifically in the xsk_buff_valid_tx_metadata() function. The root cause is insufficient validation that the registered metadata area contains the complete xsk_tx_metadata.request.launch_time field before it is accessed. Additionally, the flags field could be modified concurrently by user space between validation and use, leading to inconsistent security decisions (time-of-check-time-of-use race). The fix adds proper length validation when XDP_TXMD_FLAGS_LAUNCH_TIME is set and snapshots the validated flags for consistent use throughout the transmit path. Exploitation requires local access and the ability to use AF_XDP sockets; no network vector exists.
Affected products
- Linux Linux kernel affected versions prior to fix commit 439ce2dddf3d22129b9113a7881637256a35e936 (July 2026)
Timeline
- 2026-08-22: disclosed
- 2026-07-27: patched: fix committed upstream