CVE-2026-90115: xsk: fix NULL pointer dereference in __xsk_rcv()
In the Linux kernel, the following vulnerability has been resolved:
xsk: fix NULL pointer dereference in xskrcv()
In the xskrcv() multi-buffer path, xskbuffalloc() is called in a loop without checking its return value. xskbuffcanalloc() only counts fill queue entries without validating their addresses, so it can succeed while xskbuffalloc() rejects all remaining entries and returns NULL.
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000 KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:xskrcv+0x426/0xc20 (net/xdp/xsk.c:350) Call Trace: xskgenericrcv+0x26d/0x5f0 xdpdogenericredirect+0x3c5/0xcf0 doxdpgeneric+0x92f/0xe70 netifreceiveskbcore.constprop.0+0xf7e/0x2b30
Fix this with a two-stage transaction. First allocate and stage all buffers required for the packet, recycling all staged buffers with xskbufffree() if any allocation fails. Only after this stage succeeds, copy the data, reserve the RX descriptors, and release the buffers in an error-free loop.
Event History
Frequently Asked Questions
What runtime conditions trigger the fault?
The fault occurs in the multi-buffer receive path when the fill queue has entries that are counted as available but whose addresses are rejected by xsk_buff_alloc(). If all remaining allocations fail, the unchecked NULL return value is later dereferenced.
What is the observable impact?
The kernel can hit a general protection fault and KASAN-reported NULL pointer dereference in __xsk_rcv(). The shown call trace reaches the affected code through xsk_generic_rcv(), xdp_do_generic_redirect(), and the generic XDP receive path.
What does the fix change to prevent the crash?
The fix allocates and stages every buffer needed for a packet before copying data or reserving RX descriptors. If any allocation fails, it frees the staged buffers; only a fully successful allocation stage proceeds to descriptor handling.