CVE-2026-43092

Vulnerability

Description

The AF_XDP socket implementation in the Linux kernel failed to validate whether a device's MTU fits within the usable frame space of a UMEM chunk at bind time. When tailroom and headroom are subtracted from the chunk size, a 2 kiB chunk may not provide enough room for a standard 1500-byte MTU, leading to potential buffer overflows or data corruption during zero-copy packet processing [1][2][4].

Attack

Vector and Prerequisites

An attacker would need the ability to set up AF_XDP sockets with zero-copy mode on a system, which typically requires CAP_NET_RAW or equivalent privileges. By binding an XSK to a device with an MTU larger than the usable frame size derived from the UMEM chunk, the kernel would proceed without rejecting the configuration, enabling out-of-bounds memory access when packets are received [3].

Impact

Successful exploitation could result in memory corruption, leading to system instability or information disclosure. An attacker could potentially corrupt adjacent UMEM regions or kernel memory, depending on the hardware's Rx buffer chain length and the configured MTU [1][2].

Mitigation

The fix adds validation during bind against both the MTU and the maximum segment count exposed via net_device::xdp_zc_max_segs. This ensures any zero-copy mapping that cannot accommodate the configured MTU is rejected early. The patch has been backported to stable kernel trees [1][2][3][4].