Executive brief
The Linux kernel's XDP socket implementation used in high-performance packet processing networking applications contains a logic error in its zero-copy transmission path. The vulnerability allows transmission metadata to be processed even when not explicitly requested by the application, potentially leading to incorrect packet handling, timestamp corruption, or unexpected checksum offload behavior. This could impact network packet processing reliability in systems relying on XDP sockets for data plane operations.
Technical details
The vulnerability is a logic flaw in the AF_XDP (XDP socket) zero-copy transmit path where the kernel reads and processes TX metadata from the UMEM (User Memory) region whenever metadata space is available, regardless of whether the XDP_TX_METADATA flag is set on the individual descriptor. The root cause is that descriptor options are not validated before processing metadata, causing metadata to be honored unconditionally. An unprivileged userspace application using AF_XDP sockets can trigger this by setting up a UMEM with metadata space and transmitting descriptors without the XDP_TX_METADATA flag set; the kernel will incorrectly process their metadata, potentially overwriting unintended timestamp values or applying unwanted checksum offloads. The vulnerability is further complicated by incomplete per-WQE metadata handling in mlx5 MPWQEs where only the descriptor starting a batch session validates metadata, leaving subsequent descriptors in the batch unchecked. Patches are available in upstream Linux kernel commits a6e4b9a6deb9362ef7a0706c70d674e92fe1411a and later.
Affected products
- Linux Linux kernel 5.0 and later (XDP socket subsystem introduced in 5.4)
Timeline
- 2026-08-19: disclosed: Upstream patch authored by Stanislav Fomichev
- 2026-08-24: patched: Merged into upstream Linux mainline
- 2026-09-14: other: Included in Linux stable tree
- 2026-09-17: advisory: Published as CVE-2026-90086