CVE-2025-40159

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

xsk: Harden userspace-supplied xdp_desc validation

Turned out certain clearly invalid values passed in xdp_desc from

userspace can pass xp_{,un}aligned_validate_desc() and then lead

to UBs or just invalid frames to be queued for xmit.

desc->len close to ``U32_MAX`` with a non-zero pool->tx_metadata_len

can cause positive integer overflow and wraparound, the same way low

enough desc->addr with a non-zero pool->tx_metadata_len can cause

negative integer overflow. Both scenarios can then pass the

validation successfully.

This doesn't happen with valid XSk applications, but can be used

to perform attacks.

Always promote desc->len to ``u64`` first to exclude positive

overflows of it. Use explicit check_{add,sub}_overflow() when

validating desc->addr (which is ``u64`` already).

bloat-o-meter reports a little growth of the code size:

add/remove: 0/0 grow/shrink: 2/1 up/down: 60/-16 (44)

Function

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References