Executive brief
The Linux kernel's virtio_net network driver contains a buffer overflow vulnerability in its receive ring resize logic when AF_XDP (a high-performance packet processing interface) is active. An attacker or local user could trigger the overflow by resizing the RX ring to a larger size, causing the driver to write beyond the allocated buffer and potentially corrupting kernel memory or causing a denial of service.
Technical details
The vulnerability is a buffer overflow in the virtnet_rx_resize() function in drivers/net/virtio_net.c. When an AF_XDP socket is attached and the receive queue ring size is increased, the XSK buffer array (rq->xsk_buffs) is not resized accordingly. This causes virtnet_rx_resume() to write past the end of the undersized buffer. The vulnerability can be triggered locally via ethtool commands to resize the RX ring (e.g., ethtool -G eth0 rx 256) while an AF_XDP socket is active. A fix allocates a temporary XSK buffer array and swaps it when the ring is successfully resized, preventing the out-of-bounds write.
Affected products
- Linux Linux kernel affected versions unknown; patch available in commit d09c98a6da215bce2173a292e4b95c8de6ea5d51
Timeline
- 2026-09-17: disclosed: CVE-2026-90142 published
- 2026-08-10: patched: Upstream patch authored by Anton Protopopov
- 2026-09-14: patched: Patch committed to stable tree by Greg Kroah-Hartman