UBUNTU-CVE-2026-90142: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: virtionet: Fix resize of the RX ring When a AFXDP socket is attached, the virtnetrxresize should resize the rq->xskbuffs XSK buffer array. Otherwise, when the size grows, the virtnetrxresume() causes a write past the end of the array. This is easily reproducable with ethtool -G ens3 rx 32 ./xdpsock -i eth0 -q 0 -r -z & ethtool -G eth0 rx 256
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using one of the listed Ubuntu Linux kernel packages are exposed when a virtio-net interface has an AF_XDP socket attached and its receive ring is resized. The affected package list includes linux-riscv, linux-realtime, linux-hwe-edge, linux-azure, linux-gcp, linux-azure-fde, linux-gke, and linux-aws-5.0.
What access does an attacker need to exploit it?
The vulnerability has local attack vector, low attack complexity, no user interaction, and requires low privileges. Exploitation requires the ability to attach an AF_XDP socket to a virtio-net interface and trigger a receive-ring resize.
Is a default virtio-net configuration affected?
The issue depends on an AF_XDP socket being attached and a subsequent RX ring resize. The provided information does not establish that this condition exists in a default configuration.
What can be done if an update cannot be applied immediately?
Avoid attaching AF_XDP sockets to virtio-net interfaces and avoid resizing the affected interface's RX ring while an AF_XDP socket is attached. Restrict local low-privileged access where possible, since exploitation is local and requires low privileges.
How can administrators identify potentially affected activity?
Check for virtio-net interfaces with AF_XDP sockets attached and for RX ring size changes, including changes made with ethtool -G. A resize that increases the ring size after AF_XDP attachment is the relevant condition described.