In the Linux kernel, the following vulnerability has been resolved:
xsk: fix usage of multi-buffer BPF helpers for ZC XDP
Currently when packet is shrunk via bpf_xdp_adjust_tail() and memory type is set to MEM_TYPE_XSK_BUFF_POOL, null ptr dereference happens:
[1136314.192256] BUG: kernel NULL pointer dereference, address: 0000000000000034 [1136314.203943] #PF: supervisor read access in kernel mode [1136314.213768] #PF: error_code(0x0000) - not-present page [1136314.223550] PGD 0 P4D 0 [1136314.230684] Oops: 0000 [#1] PREEMPT SMP NOPTI [1136314.239621] CPU: 8 PID: 54203 Comm: xdpsock Not tainted 6.6.0+ #257 [1136314.250469] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019 [1136314.265615] RIP: 0010:__xdp_return+0x6c/0x210 [1136314.274653] Code: ad 00 48 8b 47 08 49 89 f8 a8 01 0f 85 9b 01 00 00 0f 1f 44 00 00 f0 41 ff 48 34 75 32 4c 89 c7 e9 79 cd 80 ff 83 fe 03 75 17 <f6> 41 34 01 0f 85 02 01 00 00 48 89 cf e9 22 cc 1e 00 e9 3d d2 86 [1136314.302907] RSP: 0018:ffffc900089f8db0 EFLAGS: 00010246 [1136314.312967] RAX: ffffc9003168aed0 RBX: ffff8881c3300000 RCX: 0000000000000000 [1136314.324953] RDX: 0000000000000000 RSI: 0000000000000003 RDI: ffffc9003168c000 [1136314.336929] RBP: 0000000000000ae0 R08: 0000000000000002 R09: 0000000000010000 [1136314.348844] R10: ffffc9000e495000 R11: 0000000000000040 R12: 0000000000000001 [1136314.360706] R13: 0000000000000524 R14: ffffc9003168aec0 R15: 0000000000000001 [1136314.373298] FS: 00007f8df8bbcb80(0000) GS:ffff8897e0e00000(0000) knlGS:0000000000000000 [1136314.386105] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [1136314.396532] CR2: 0000000000000034 CR3: 00000001aa912002 CR4: 00000000007706f0 [1136314.408377] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [1136314.420173] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [1136314.431890] PKRU: 55555554 [1136314.439143] Call Trace: [1136314.446058] <IRQ> [1136314.452465] ? __die+0x20/0x70 [1136314.459881] ? page_fault_oops+0x15b/0x440 [1136314.468305] ? exc_page_fault+0x6a/0x150 [1136314.476491] ? asm_exc_page_fault+0x22/0x30 [1136314.484927] ? __xdp_return+0x6c/0x210 [1136314.492863] bpf_xdp_adjust_tail+0x155/0x1d0 [1136314.501269] bpf_prog_ccc47ae29d3b6570_xdp_sock_prog+0x15/0x60 [1136314.511263] ice_clean_rx_irq_zc+0x206/0xc60 [ice] [1136314.520222] ? ice_xmit_zc+0x6e/0x150 [ice] [1136314.528506] ice_napi_poll+0x467/0x670 [ice] [1136314.536858] ? ttwu_do_activate.constprop.0+0x8f/0x1a0 [1136314.546010] __napi_poll+0x29/0x1b0 [1136314.553462] net_rx_action+0x133/0x270 [1136314.561619] __do_softirq+0xbe/0x28e [1136314.569303] do_softirq+0x3f/0x60
This comes from __xdp_return() call with xdp_buff argument passed as NULL which is supposed to be consumed by xsk_buff_free() call.
To address this properly, in ZC case, a node that represents the frag being removed has to be pulled out of xskb_list. Introduce appropriate xsk helpers to do such node operation and use them accordingly within bpf_xdp_adjust_tail().
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 27, 2026 | Jul 27, 2026 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Dec 5, 2024 | Mar 11, 2024 |
| Suse | — | Upgrade kernel-rt_debug-livepatch-develUpgrade kernel-kvmsmall-livepatch-develUpgrade kselftests-kmp-azureUpgrade kernel-azure-extraUpgrade kernel-default-baseUpgrade dtb-broadcomUpgrade kernel-rt-livepatch-develUpgrade dtb-sprdUpgrade dtb-hisiliconUpgrade dlm-kmp-azureUpgrade kernel-zfcpdumpUpgrade ocfs2-kmp-defaultUpgrade gfs2-kmp-64kbUpgrade dtb-socionextUpgrade kernel-default-livepatchUpgrade kernel-debugUpgrade kernel-syms-rtUpgrade kernel-64kbUpgrade kernel-develUpgrade kernel-64kb-optionalUpgrade dtb-amdUpgrade cluster-md-kmp-64kbUpgrade kernel-rt_debug-develUpgrade dtb-marvellUpgrade dtb-amazonUpgrade gfs2-kmp-defaultUpgrade kernel-kvmsmall-vdsoUpgrade kernel-rt-optionalUpgrade dlm-kmp-defaultUpgrade kernel-default-livepatch-develUpgrade kernel-azure-vdsoUpgrade dtb-renesasUpgrade dlm-kmp-rtUpgrade reiserfs-kmp-defaultUpgrade kselftests-kmp-rtUpgrade reiserfs-kmp-64kbUpgrade ocfs2-kmp-azureUpgrade kernel-source-rtUpgrade kselftests-kmp-defaultUpgrade kernel-docs-htmlUpgrade kernel-default-develUpgrade kernel-64kb-develUpgrade dtb-freescaleUpgrade dtb-appleUpgrade kernel-rt_debugUpgrade kernel-symsUpgrade kernel-rt_debug-vdsoUpgrade reiserfs-kmp-rtUpgrade kernel-debug-develUpgrade ocfs2-kmp-64kbUpgrade dtb-allwinnerUpgrade kernel-64kb-extraUpgrade kernel-docsUpgrade kernel-defaultUpgrade kernel-64kb-livepatch-develUpgrade kernel-rtUpgrade kernel-sourceUpgrade kernel-syms-azureUpgrade dtb-caviumUpgrade cluster-md-kmp-rtUpgrade kernel-source-azureUpgrade cluster-md-kmp-azureUpgrade dtb-mediatekUpgrade kernel-azureUpgrade dlm-kmp-64kbUpgrade reiserfs-kmp-azureUpgrade kernel-debug-livepatch-develUpgrade cluster-md-kmp-defaultUpgrade kselftests-kmp-64kbUpgrade kernel-azure-develUpgrade dtb-xilinxUpgrade ocfs2-kmp-rtUpgrade kernel-source-vanillaUpgrade kernel-azure-optionalUpgrade kernel-default-base-rebuildUpgrade kernel-rt-develUpgrade gfs2-kmp-rtUpgrade kernel-kvmsmallUpgrade kernel-rt-extraUpgrade dtb-nvidiaUpgrade kernel-debug-vdsoUpgrade kernel-kvmsmall-develUpgrade dtb-apmUpgrade dtb-alteraUpgrade kernel-obs-qaUpgrade kernel-rt-vdsoUpgrade dtb-amlogicUpgrade dtb-rockchipUpgrade kernel-azure-livepatch-develUpgrade kernel-default-optionalUpgrade gfs2-kmp-azureUpgrade kernel-obs-buildUpgrade kernel-default-vdsoUpgrade dtb-qcomUpgrade dtb-lgUpgrade kernel-devel-azureUpgrade dtb-armUpgrade kernel-devel-rtUpgrade dtb-exynosUpgrade kernel-default-extraUpgrade kernel-macros | Jun 24, 2024 | Mar 11, 2024 |
| Ubuntu | — | Upgrade linux-raspi-realtime | Feb 11, 2025 | Mar 11, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub