CVE-2025-21997

In the Linux kernel, the following vulnerability has been resolved:

xsk: fix an integer overflow in xp_create_and_assign_umem()

Since the i and pool->chunk_size variables are of type 'u32', their product can wrap around and then be cast to 'u64'. This can lead to two different XDP buffers pointing to the same memory area.

Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with SVACE.

This flaw is rated as Moderate severity rather than Important because exploitation requires local access with the necessary privileges to configure AF_XDP socket memory pools, restricting the attack surface to specialized high-performance networking applications. Under standard Red Hat Enterprise Linux deployments, AF_XDP functionality is not utilized by default services. A local authenticated attacker triggering this arithmetic wraparound can cause distinct packet buffers to reference overlapping memory addresses, resulting in system denial of service or potential packet data leakage.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.