Executive brief
AF_XDP is a Linux kernel networking feature that allows user-space applications to send network packets with custom metadata. The kernel was accepting metadata buffers as small as 8 bytes, but this was insufficient and allowed the kernel to read beyond the boundaries of the user-allocated memory region. This could leak sensitive kernel data to applications with AF_XDP socket access.
Technical details
A buffer over-read vulnerability exists in the AF_XDP TX metadata length validation within the Linux kernel's xdp_umem_reg() function. The kernel accepts TX metadata lengths as small as 8 bytes, but every supported request type requires a flags field plus at least one 8-byte request field (16 bytes minimum). When metadata shorter than 16 bytes is provided, the kernel reads beyond the registered user-space memory area. The fix enforces a minimum TX metadata length of 16 bytes in net/xdp/xdp_umem.c. The vulnerability requires the attacker to have permissions to create AF_XDP sockets, which is typically restricted. Patches are available in kernel commits 1bb30b181d9f0484e141f8411e15ed906d5c6780 and subsequent stable tree backports.
Affected products
- Linux Linux Kernel versions including the vulnerable xsk TX metadata feature; fixed in commits 1bb30b181d9f0484e141f8411e15ed906d5c6780 and backported to stable branches
Timeline
- 2026-07-20: other: Vulnerability reported to kernel maintainers
- 2026-07-27: other: Fix committed upstream
- 2026-08-03: patched: Fix merged by Jakub Kicinski
- 2026-08-19: patched: Backported to stable kernel trees by Greg Kroah-Hartman
- 2026-08-22: disclosed