CVE-2024-39293: Revert "xsk: Support redirect to any socket bound to the same umem"

Severity: medium (CVSS 4.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-06-25 · updated 2026-08-04
Weakness: CWE-362

Description

In the Linux kernel, the following vulnerability has been resolved: Revert "xsk: Support redirect to any socket bound to the same umem" This reverts commit 2863d665ea41282379f108e4da6c8a2366ba66db. This patch introduced a potential kernel crash when multiple napi instances redirect to the same AF_XDP socket. By removing the queue_index check, it is possible for multiple napi instances to access the Rx ring at the same time, which will result in a corrupted ring state which can lead to a crash when flushing the rings in __xsk_flush(). This can happen when the linked list of sockets to flush gets corrupted by concurrent accesses. A quick and small fix is not possible, so let us revert this for now.

Affected products

Linux kernel: from 6.9 before 6.9.5; 6.10-rc1, 6.10-rc2 — fixed in 6.9.5

How to fix

Upgrade to a fixed version: Linux kernel 6.9.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-39293 or the next vulnerability affects your stack