CVE-2025-37920: xsk: Fix race condition in AF_XDP generic RX path
In the Linux kernel, the following vulnerability has been resolved:
xsk: Fix race condition in AFXDP generic RX path
Move rxlock from xsksocket to xskbuffpool. Fix synchronization for shared umem mode in generic RX path where multiple sockets share single xskbuffpool.
RX queue is exclusive to xsksocket, while FILL queue can be shared between multiple sockets. This could result in race condition where two CPU cores access RX path of two different sockets sharing the same umem.
Protect both queues by acquiring spinlock in shared xskbuffpool.
Lock contention may be minimized in the future by some per-thread FQ buffering.
It's safe and necessary to move spinlockbh(rxlock) after xskrcvcheck(): xs->pool and spinlockinit is synchronized by xskbind() -> xskisbound() memory barriers. xskrcvcheck() may return true at the moment of xskrelease() or xskunbinddev(), however this will not cause any data races or race conditions. xskunbinddev() removes xdp socket from all maps and waits for completion of all outstanding rx operations. Packets in RX path will either complete safely or drop.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.126.1-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-37920?
The severity of CVE-2025-37920 is classified as medium due to its potential impact on system stability and performance.
How do I fix CVE-2025-37920?
To fix CVE-2025-37920, update your Linux kernel to the latest version where the vulnerability has been patched.
What component is affected by CVE-2025-37920?
CVE-2025-37920 affects the AF_XDP implementation in the Linux kernel that handles the generic RX path.
Can CVE-2025-37920 be exploited remotely?
CVE-2025-37920 requires local access to the system, making remote exploitation unlikely.
What are the symptoms of CVE-2025-37920?
Symptoms of CVE-2025-37920 may include performance degradation or instability when using multiple sockets sharing an xsk_buff_pool.