CVE-2026-90115

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xsk: fix NULL pointer dereference in __xsk_rcv()

In the __xsk_rcv() multi-buffer path, xsk_buff_alloc() is called in a

loop without checking its return value. xsk_buff_can_alloc() only

counts fill queue entries without validating their addresses, so it

can succeed while xsk_buff_alloc() rejects all remaining entries and

returns NULL.

Oops: general protection fault, probably for non-canonical address

0xdffffc0000000000

KASAN: null-ptr-deref in range

[0x0000000000000000-0x0000000000000007]

RIP: 0010:__xsk_rcv+0x426/0xc20 (net/xdp/xsk.c:350)

Call Trace:

xsk_generic_rcv+0x26d/0x5f0

xdp_do_generic_redirect+0x3c5/0xcf0

do_xdp_generic+0x92f/0xe70

__netif_receive_skb_core.constprop.0+0xf7e/0x2b30

Fix this with a two-stage transaction. First allocate and stage all

buffers required for the packet, recycling all staged buffers with

xsk_buff_free() if any allocation fails. Only after this stage

succee

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References