xsk: Fix xsk_diag use-after-free error during socket cleanup (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.15 % · percentile 5 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Modified
Description
In the Linux kernel, the following vulnerability has been resolved: xsk: Fix xsk_diag use-after-free error during socket cleanup Fix a use-after-free error that is possible if the xsk_diag interface is used after the socket has been unbound from the device. This can happen either due to the socket being closed or the device disappearing. In the early days of AF_XDP, the way we tested that a socket was not bound to a device was to simply check if the netdevice pointer in the xsk socket structure was NULL. Later, a better system was introduced by having an explicit state variable in the xsk socket struct. For example, the state of a socket that is on the way to being closed and has been unbound from the device is XSK_UNBOUND. The commit in the Fixes tag below deleted the old way of signalling that a socket is unbound, setting dev to NULL. This in the belief that all code using the old way had been exterminated. That was unfortunately not true as the xsk diagnostics code was still using the old way and thus does not work as intended when a socket is going down. Fix this by introducing a test against the state variable. If the socket is in the state XSK_UNBOUND, simply abort the diagnostic's netlink operation.
Weaknesses (CWE)
- CWE-416 — Use After Free
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | Linux |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
European references
- ENISA EUVD · EUVD-2025-29878
- GCVE · GCVE-0-2023-53426
CERT-FR advisories
- CERTFR-2025-AVI-1032 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-1009 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0921 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0895 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.15.33 < 5.15.132cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.16.19 < 5.17cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.17.2 < 6.1.54cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.2 < 6.5.4
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected ad7219cd8751bd258b9d1e69ae0654ec00f71875 < 5979985f2d6b565b6cf0f79a62670a2855c0e96c ; affected 18b1ab7aa76bde181bdb1ab19a87fa9523c32f21 < 6436973164ea5506a495f39e56be5aea375e7832 ; affected 18b1ab7aa76bde181bdb1ab19a87fa9523c32f21 < 595931912357fa3507e522a7f8a0a76e423c23e4 ; affected 18b1ab7aa76bde181bdb1ab19a87fa9523c32f21 < 3e019d8a05a38abb5c85d4f1e85fda964610aa14 ; affected d1579253ffce39986e7a6ab757ac93b2680a665f ; affected 8a2dea162b92c322f3e42eae0c4a74b8d20aa7a9 |
| Linux · Linux | affected 5.18 ; unaffected 0 < 5.18 ; unaffected 5.15.132 ≤ 5.15.* ; unaffected 6.1.54 ≤ 6.1.* ; unaffected 6.5.4 ≤ 6.5.* ; unaffected 6.6 ≤ * |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |