VYPR
← All advisories
Medium severity5.5NVD Advisory· Published May 17, 2024· Updated May 12, 2026

CVE-2024-27431

CVE-2024-27431

Description

In the Linux kernel, the following vulnerability has been resolved:

cpumap: Zero-initialise xdp_rxq_info struct before running XDP program

When running an XDP program that is attached to a cpumap entry, we don't initialise the xdp_rxq_info data structure being used in the xdp_buff that backs the XDP program invocation. Tobias noticed that this leads to random values being returned as the xdp_md->rx_queue_index value for XDP programs running in a cpumap.

This means we're basically returning the contents of the uninitialised memory, which is bad. Fix this by zero-initialising the rxq data structure before running the XDP program.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In the Linux kernel, a missing zero-initialization of the xdp_rxq_info struct in cpumap can cause XDP programs to leak uninitialized kernel memory via the rx_queue_index field.

Vulnerability

In the Linux kernel, when an XDP program is attached to a CPU map (cpumap) entry, the xdp_rxq_info structure backing the xdp_buff is not initialized before the XDP program runs. This leads to the xdp_md->rx_queue_index field containing random stack values from uninitialized memory, which is then returned to the XDP program. The root cause is a missing zero-initialization of the xdp_rxq_info struct before executing the XDP program within the cpumap context [1].

Exploitation

The vulnerability is exploitable only when an XDP program is attached to a CPU map entry. No special privileges beyond those required to load and attach XDP programs are needed; however, the attacker must have the ability to run XDP programs on the system, which typically requires root or CAP_NET_ADMIN capabilities. The uninitialized data is exposed directly to the XDP program, which can read the rx_queue_index field. A local attacker could craft an XDP program that reads this field and potentially leaks sensitive kernel stack data [1].

Impact

An attacker with the ability to run XDP programs can leverage this information leak to obtain potentially sensitive kernel memory contents, such as pointers or other data left on the stack. While the CVSS v3 score is 5.5 (Medium), the impact is limited to information disclosure and does not directly allow code execution or privilege escalation [1].

Mitigation

The vulnerability was fixed in the Linux kernel by zero-initializing the xdp_rxq_info struct before running the XDP program in the cpumap context. Patches have been applied to the stable kernel tree [2][3][4]. Users should update to a kernel version containing the fix. The Siemens advisory SSA-265688 notes that affected products (e.g., SIMATIC S7-1500 TM MFP - GNU/Linux subsystem) are impacted by this and other CVEs [1].

References
  1. SSA-265688
  2. Making sure you're not a bot!
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

93

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

8

News mentions

0

No linked articles in our index yet.