CVE-2026-90142: virtio_net: Fix resize of the RX ring
In the Linux kernel, the following vulnerability has been resolved:
virtionet: Fix resize of the RX ring
When a AFXDP socket is attached, the virtnetrxresize should resize the rq->xskbuffs XSK buffer array. Otherwise, when the size grows, the virtnetrxresume() causes a write past the end of the array. This is easily reproducable with
ethtool -G ens3 rx 32 ./xdpsock -i eth0 -q 0 -r -z & ethtool -G eth0 rx 256
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems using the Linux virtio_net driver with an AF_XDP socket attached to a receive queue are exposed when the RX ring is resized to a larger size.
What is required to trigger the out-of-bounds write?
An attacker or local operator must be able to attach an AF_XDP socket and change the virtio_net interface RX ring size. The write past the end of the XSK buffer array occurs when the ring grows and receive processing resumes.
Is resizing the RX ring downward affected?
The described out-of-bounds condition occurs when the RX ring size grows. The issue is caused by failing to resize the rq->xsk_buffs array along with the enlarged RX ring.
How can administrators tell whether a system may be affected?
Check whether an AF_XDP socket is attached to a virtio_net receive queue and whether the interface RX ring has been enlarged using RX ring resizing, such as through ethtool.