UBUNTU-CVE-2026-90115: Null Pointer Dereference
In the Linux kernel, the following vulnerability has been resolved: xsk: fix NULL pointer dereference in xskrcv() In the xskrcv() multi-buffer path, xskbuffalloc() is called in a loop without checking its return value. xskbuffcanalloc() only counts fill queue entries without validating their addresses, so it can succeed while xskbuffalloc() rejects all remaining entries and returns NULL. Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000 KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:xskrcv+0x426/0xc20 (net/xdp/xsk.c:350) Call Trace: xskgenericrcv+0x26d/0x5f0 xdpdogenericredirect+0x3c5/0xcf0 doxdpgeneric+0x92f/0xe70 netifreceiveskbcore.constprop.0+0xf7e/0x2b30 Fix this with a two-stage transaction. First allocate and stage all buffers required for the packet, recycling all staged buffers with xskbufffree() if any allocation fails. Only after this stage succeeds, copy the data, reserve the RX descriptors, and release the buffers in an error-free loop.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Fix the __xsk_rcv() multi-buffer path using a two-stage transaction: first allocate and stage all packet buffers, recycle every staged buffer with xsk_buff_free() if any xsk_buff_alloc() call fails, and only after successful staging copy the data, reserve RX descriptors, and release the buffers in an error-free loop.
Event History
Frequently Asked Questions
Which systems are in scope?
The affected Ubuntu kernel package families listed are linux-riscv, linux-realtime, linux-azure, linux-gcp, linux-azure-fde, linux-gke, linux-hwe-edge, and linux-gkeop.
What conditions trigger the failure?
The failure occurs in the AF_XDP receive multi-buffer path when the fill queue count indicates buffers are available but their addresses are rejected by xsk_buff_alloc(). If allocation returns NULL and the path continues, __xsk_rcv() can dereference the NULL buffer pointer.
What is the likely impact of successful triggering?
The provided crash trace shows a kernel NULL-pointer dereference and general protection fault in __xsk_rcv(). This can cause an Oops or kernel crash while processing traffic through the affected receive and XDP redirect path.