CVE-2026-53250

A flaw was found in the Linux kernel's xsk (AF_XDP socket) component. A malicious local userspace application can exploit a Time-of-check to time-of-use (TOCTOU) race condition in the xsk_skb_metadata() function. By modifying checksum-related values in shared memory between validation and use, an attacker can bypass security checks. This leads to out-of-bounds memory access during network packet transmission, potentially causing a denial of service (system crash) or compromising data integrity and confidentiality.

A TOCTOU race in xsk_skb_metadata can occur because csum_start and csum_offset are read from mmap writable UMEM metadata for bounds validation and then read again for skb assignment. A malicious local userspace application can change these fields between the two reads, causing the validated values and the used values to differ. This can bypass the checksum bounds check and cause out of bounds memory access during checksum computation in the transmit path. For the CVSS the PR:L is used because the attacker needs local code execution and access to AF_XDP or an already usable XSK/UMEM transmit path, but does not necessarily need full host administrator privileges in all deployments. The issue is not directly network reachable as AV:N because packet traffic alone does not trigger it without local control of the UMEM metadata. Impact is at least local denial of service via kernel crash, and in the paranoid interpretation may allow confidentiality or integrity impact due to memory corruption risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.