CVE-2026-90142: virtio_net: Fix resize of the RX ring

Published Sep 17, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

virtionet: Fix resize of the RX ring

When a AFXDP socket is attached, the virtnetrxresize should resize the rq->xskbuffs XSK buffer array. Otherwise, when the size grows, the virtnetrxresume() causes a write past the end of the array. This is easily reproducable with

ethtool -G ens3 rx 32 ./xdpsock -i eth0 -q 0 -r -z & ethtool -G eth0 rx 256

Event History

Sep 17, 2026
CVE Published
via MITRE·04:06 PM
Data Sourced
via MITRE·04:06 PM
Description

Frequently Asked Questions

1

What systems are exposed to this issue?

Systems using the Linux virtio_net driver with an AF_XDP socket attached to a receive queue are exposed when the RX ring is resized to a larger size.

2

What is required to trigger the out-of-bounds write?

An attacker or local operator must be able to attach an AF_XDP socket and change the virtio_net interface RX ring size. The write past the end of the XSK buffer array occurs when the ring grows and receive processing resumes.

3

Is resizing the RX ring downward affected?

The described out-of-bounds condition occurs when the RX ring size grows. The issue is caused by failing to resize the rq->xsk_buffs array along with the enlarged RX ring.

4

How can administrators tell whether a system may be affected?

Check whether an AF_XDP socket is attached to a virtio_net receive queue and whether the interface RX ring has been enlarged using RX ring resizing, such as through ethtool.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203