CVE-2026-23326: xsk: Fix fragment node deletion to prevent buffer leak
In the Linux kernel, the following vulnerability has been resolved:
xsk: Fix fragment node deletion to prevent buffer leak
After commit b692bf9a7543 ("xsk: Get rid of xdpbuffxsk::xskblistnode"), the listnode field is reused for both the xskb pool list and the buffer free list, this causes a buffer leak as described below.
xpfree() checks if a buffer is already on the free list using listempty(&xskb->listnode). When listdel() is used to remove a node from the xskb pool list, it doesn't reinitialize the node pointers. This means listempty() will return false even after the node has been removed, causing xpfree() to incorrectly skip adding the buffer to the free list.
Fix this by using listdelinit() instead of listdel() in all fragment handling paths, this ensures the list node is reinitialized after removal, allowing the listempty() to work correctly.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Replace list_del() with list_del_init() in all fragment handling paths so the list node is reinitialized after removal and list_empty(&xskb->list_node) works correctly.
Linux kernel xsk fragment handling fragment node deletion function = list_del_init()
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The CVSS vector indicates local access and low privileges are required, with no user interaction needed. The impact can include high confidentiality, integrity, and availability effects.
What should administrators do to remediate the issue?
Apply an available Linux kernel patch. The fix changes fragment-handling paths to reinitialize list nodes after removal so buffers can be returned to the free list correctly.