CVE-2025-40159

Integer overflow vulnerabilities were found in the Linux kernel's XDP socket descriptor validation. A local user can trigger these issues by supplying crafted xdp_desc values through AF_XDP sockets—either desc->len values near U32_MAX that overflow when added to metadata length, or extremely low desc->addr values that underflow when subtracting metadata length. Both bypass validation checks and allow invalid frames to be queued for transmission or cause undefined behavior, resulting in denial of service.

AF_XDP allows userspace to submit packet descriptors for zero-copy transmission. The validation functions check that descriptor addresses and lengths are within pool boundaries. When tx_metadata_len is non-zero, calculations add it to desc->len or subtract it from desc->addr. Since desc->len is u32, values near U32_MAX can wrap around when metadata is added, making invalid large sizes appear valid. Similarly, low desc->addr values can underflow during subtraction, passing validation incorrectly. While legitimate XDP applications don't send such values, attackers can exploit these overflows. The fix promotes desc->len to u64 before arithmetic and uses explicit overflow checking for desc->addr calculations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.