Executive brief
The Linux kernel's AF_XDP socket implementation contains a null pointer dereference vulnerability in multi-buffer packet reception. This can cause a kernel crash (denial of service) when the system attempts to receive packets over AF_XDP sockets, affecting applications using this high-performance networking interface for packet processing.
Technical details
The vulnerability is a NULL pointer dereference in the __xsk_rcv() function in net/xdp/xsk.c within the multi-buffer receive path. The root cause is that xsk_buff_alloc() is called in a loop without checking its return value, while the prior check using xsk_buff_can_alloc() only counts fill queue entries without validating their addresses. This mismatch allows xsk_buff_can_alloc() to succeed while xsk_buff_alloc() fails and returns NULL, leading to dereferencing a NULL pointer. The fix uses a two-stage transaction: first allocate all required buffers and stage them in a list, recycling them if any allocation fails; only then proceed with data copying in an error-free loop. This vulnerability affects the multi-buffer support added in commit 804627751b42 and is triggered when receiving packets over AF_XDP sockets.
Affected products
- Linux Linux kernel 5.0 and later (up to the patch date)
Timeline
- 2026-09-17: disclosed
- 2026-09-14: patched