Description

In the Linux kernel, the following vulnerability has been resolved: veth: convert frag_list skbs before running XDP A frag_list skb can reach veth with data_len set but nr_frags zero. veth_convert_skb_to_xdp_buff() only converts skbs that are shared, locked, have frags[], or do not have enough headroom. It later uses skb_is_nonlinear() to decide whether to set XDP_FLAGS_HAS_FRAGS and xdp_frags_size. That exposes frag_list data to XDP as if it were stored in frags[], but frags[] is empty. AF_XDP copy mode can then trust the bogus XDP fragment metadata, walk an empty fragment entry, and crash in memcpy() from __xsk_rcv(). Route non-linear skbs through skb_pp_cow_data() before exposing them to XDP, and only advertise XDP frags when the resulting skb has frags[]. skb_copy_bits() already handles frag_list input, and skb_pp_cow_data() builds frags[] output with skb_add_rx_frag(), which is the representation XDP multi-buffer expects.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-15T13:17:52.397Z",
  "pubdate": "2026-08-15T13:17:52.397Z",
  "executiveSummary": "A vulnerability exists in the Linux kernel veth driver related to the handling of non-linear socket buffers (skbs) processed by the eXpress Data Path (XDP) subsystem.\nThe vulnerability type involves incorrect memory management and metadata validation leading to a buffer handling error.\nThe impact of this vulnerability is a kernel crash resulting in a Denial of Service (DoS) affecting systems utilizing virtual Ethernet interfaces with XDP enabled.\nThe affected product is the Linux kernel, specifically the veth driver and AF_XDP subsystem.\nThe risk implications include potential system instability and unexpected reboots due to kernel panics triggered by malformed network packets.\nAttacker capabilities include the ability to send specially crafted network packets containing a frag_list skb with data_len set but nr_frags zero through a virtual Ethernet interface.\nExploitation requirements include network packet injection capability and an active XDP consumer such as AF_XDP copy mode configured on the veth interface.",
  "technicalDetails": "The root cause of the vulnerability stems from how veth_convert_skb_to_xdp_buff() handles non-linear socket buffers containing a frag_list.\nSpecifically, a frag_list skb can reach the veth driver with a non-zero data_len but an empty frags[] array (nr_frags set to zero).\nThe conversion function initially checks for shared status, locking, existing frags[], or insufficient headroom, but relies subsequently on skb_is_nonlinear() to determine XDP_FLAGS_HAS_FRAGS and compute xdp_frags_size.\nThis logic incorrectly exposes frag_list data to the XDP subsystem as if the data were stored within the frags[] array, despite frags[] remaining empty.\nDuring AF_XDP copy mode processing, the subsystem trusts the bogus XDP fragment metadata and attempts to walk the empty fragment entries.\nWhen __xsk_rcv() executes a memcpy() operation using this invalid fragment metadata, an out-of-bounds memory access or null-pointer dereference occurs, triggering a kernel panic and crash.\nThe vulnerable component is the veth driver implementation within the Linux kernel networking stack, specifically the interaction between skb conversion routines and AF_XDP.\nAuthentication and privilege requirements depend on the ability to inject network traffic or configure network interfaces, but typically local or remote packet injection into the virtual interface is sufficient.\nNetwork exposure is constrained to systems utilizing veth interfaces coupled with XDP applications, such as container environments using AF_XDP sockets.\nThe attack flow requires an actor to transmit or generate a frag_list skb that traverses a veth interface configured with XDP, leading to the malformed metadata interpretation and subsequent memory corruption during packet reception in __xsk_rcv()."
}