{"id":"CVE-2025-40159","revision":"9bf175efdbc5435a964877c9dc03d901","records":[{"revision":"9bf175efdbc5435a964877c9dc03d901","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-40159","aliases":[],"title":"xsk: Harden userspace-supplied xdp_desc validation","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: Harden userspace-supplied xdp_desc validation\n\nTurned out certain clearly invalid values passed in xdp_desc from\nuserspace can pass xp_{,un}aligned_validate_desc() and then lead\nto UBs or just invalid frames to be queued for xmit.\n\ndesc->len close to ``U32_MAX`` with a non-zero pool->tx_metadata_len\ncan cause positive integer overflow and wraparound, the same way low\nenough desc->addr with a non-zero pool->tx_metadata_len can cause\nnegative integer overflow. Both scenarios can then pass the\nvalidation successfully.\nThis doesn't happen with valid XSk applications, but can be used\nto perform attacks.\n\nAlways promote desc->len to ``u64`` first to exclude positive\noverflows of it. Use explicit check_{add,sub}_overflow() when\nvalidating desc->addr (which is ``u64`` already).\n\nbloat-o-meter reports a little growth of the code size:\n\nadd/remove: 0/0 grow/shrink: 2/1 up/down: 60/-16 (44)\nFunction                                     old     new   delta\nxskq_cons_peek_desc                          299     330     +31\nxsk_tx_peek_release_desc_batch               973    1002     +29\nxsk_generic_xmit                            3148    3132     -16\n\nbut hopefully this doesn't hurt the performance much.","state":0,"publishedAt":"2025-11-12T10:24:36.104+00:00","modifiedAt":"2026-10-15T22:02:39.041+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/xdp/xsk_queue.h\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"341ac980eab90ac1f6c22ee9f9da83ed9604d899\",\n                            \"lessThan\": \"1463cd066f32efd56ddfd3ac4e3524200f362980\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"341ac980eab90ac1f6c22ee9f9da83ed9604d899\",\n                            \"lessThan\": \"5b5fffa7c81e55d8c8edf05ad40d811ec7047e21\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"341ac980eab90ac1f6c22ee9f9da83ed9604d899\",\n                            \"lessThan\": \"07ca98f906a403637fc5e513a872a50ef1247f3b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/xdp/xsk_queue.h\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.8\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.8\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.54\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.17.4\",\n                            \"lessThanOrEqual\": \"6.17.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/1463cd066f32efd56ddfd3ac4e3524200f362980","https://git.kernel.org/stable/c/5b5fffa7c81e55d8c8edf05ad40d811ec7047e21","https://git.kernel.org/stable/c/07ca98f906a403637fc5e513a872a50ef1247f3b"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-40159","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-40159","identifiers":["CVE-2025-40159"]},"retained":false,"historicalAffected":[]}],"coverage":[]}