CVE-2025-40159
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-40159
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-40159.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-40159
- Downstream
- Published
- 2025-11-12T10:24:36.104Z
- Modified
- 2025-12-02T23:52:54.175677Z
- Summary
- xsk: Harden userspace-supplied xdp_desc validation
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
xsk: Harden userspace-supplied xdp_desc validation
Turned out certain clearly invalid values passed in xdpdesc from userspace can pass xp{,un}alignedvalidatedesc() and then lead to UBs or just invalid frames to be queued for xmit.
desc->len close to
U32_MAXwith a non-zero pool->txmetadatalen can cause positive integer overflow and wraparound, the same way low enough desc->addr with a non-zero pool->txmetadatalen can cause negative integer overflow. Both scenarios can then pass the validation successfully. This doesn't happen with valid XSk applications, but can be used to perform attacks.Always promote desc->len to
u64first to exclude positive overflows of it. Use explicit check{add,sub}overflow() when validating desc->addr (which isu64already).bloat-o-meter reports a little growth of the code size:
add/remove: 0/0 grow/shrink: 2/1 up/down: 60/-16 (44) Function old new delta xskqconspeekdesc 299 330 +31 xsktxpeekreleasedescbatch 973 1002 +29 xskgenericxmit 3148 3132 -16
but hopefully this doesn't hurt the performance much.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40159.json", "cna_assigner": "Linux" }- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/07ca98f906a403637fc5e513a872a50ef1247f3b
- https://git.kernel.org/stable/c/1463cd066f32efd56ddfd3ac4e3524200f362980
- https://git.kernel.org/stable/c/5b5fffa7c81e55d8c8edf05ad40d811ec7047e21
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40159.json
- https://nvd.nist.gov/vuln/detail/CVE-2025-40159
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced341ac980eab90ac1f6c22ee9f9da83ed9604d899Fixed1463cd066f32efd56ddfd3ac4e3524200f362980Fixed5b5fffa7c81e55d8c8edf05ad40d811ec7047e21Fixed07ca98f906a403637fc5e513a872a50ef1247f3b