CVE-2025-40159

Vulnerability

Overview The vulnerability resides in the validation logic for xdp_desc structures supplied by userspace through AF_XDP sockets. The functions xp_aligned_validate_desc() and xp_unaligned_validate_desc() failed to properly handle integer overflows when computing the total frame size. Specifically, when desc->len is close to U32_MAX and pool->tx_metadata_len is non-zero, the addition can overflow and wrap around to a small value, bypassing validation. Similarly, a low desc->addr combined with a non-zero metadata length can cause a negative integer overflow. These flaws allow crafted descriptors to pass validation and lead to undefined behavior or the transmission of invalid frames [1].

Attack

Vector The attack surface is limited to systems where AF_XDP sockets are enabled and accessible to unprivileged users. An attacker must be able to create an AF_XDP socket and submit crafted xdp_desc entries to the transmit queue. No special privileges are required beyond the ability to use AF_XDP, which is typically available to unprivileged users in default configurations. The exploitation does not require any network access; it is a local attack that can be triggered by a malicious program running on the system.

Impact

Successful exploitation can cause the kernel to queue invalid frames for transmission, potentially leading to memory corruption, information disclosure (via uninitialized or out-of-bounds memory), or a system crash. The commit message notes that this "doesn't happen with valid XSk applications, but can be used to perform attacks," indicating that the issue is exploitable by malicious userspace programs. The fix prevents integer overflows by promoting desc->len to u64 and using check_add_overflow() and check_sub_overflow() for address validation.

Mitigation

The vulnerability is patched in the Linux kernel stable commit [1]. Users should update their kernel to a version containing this fix. No workaround is available other than applying the patch. The issue is not known to be exploited in the wild, but given the local attack vector and the potential for impact, timely patching is recommended.