{"id":"CVE-2025-40159","title":"xsk: Harden userspace-supplied xdp_desc validation","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: Harden userspace-supplied xdp_desc validation\n\nTurned out certain clearly invalid values passed in xdp_desc from\nuserspace can pass xp_{,un}aligned_validate_desc()…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 341ac980eab90ac1f6c22ee9f9da83ed9604d899 < 1463cd066f32efd56ddfd3ac4e3524200f362980","Linux >= 341ac980eab90ac1f6c22ee9f9da83ed9604d899 < 5b5fffa7c81e55d8c8edf05ad40d811ec7047e21","Linux >= 341ac980eab90ac1f6c22ee9f9da83ed9604d899 < 07ca98f906a403637fc5e513a872a50ef1247f3b","Linux 6.8"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-15T21:57:23.652232Z"},"published":"2025-11-12","updated":"2026-10-15","sourceUpdated":"2026-10-15T22:02:39.041Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-40159","references":[{"url":"https://git.kernel.org/stable/c/1463cd066f32efd56ddfd3ac4e3524200f362980"},{"url":"https://git.kernel.org/stable/c/5b5fffa7c81e55d8c8edf05ad40d811ec7047e21"},{"url":"https://git.kernel.org/stable/c/07ca98f906a403637fc5e513a872a50ef1247f3b"}],"tags":["cve.org"],"epss":0.00152,"epssPercentile":0.03924,"ingestedAt":"2026-10-15T22:48:25.548Z","slug":"CVE-2025-40159","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nxsk: Harden userspace-supplied xdp_desc validation\n\nTurned out certain clearly invalid values passed in xdp_desc from\nuserspace can pass xp_{,un}aligned_validate_desc() and then lead\nto UBs or just invalid frames to be queued for xmit.\n\ndesc->len close to ``U32_MAX`` with a non-zero pool->tx_metadata_len\ncan cause positive integer overflow and wraparound, the same way low\nenough desc->addr with a non-zero pool->tx_metadata_len can cause\nnegative integer overflow. Both scenarios can then pass the\nvalidation successfully.\nThis doesn't happen with valid XSk applications, but can be used\nto perform attacks.\n\nAlways promote desc->len to ``u64`` first to exclude positive\noverflows of it. Use explicit check_{add,sub}_overflow() when\nvalidating desc->addr (which is ``u64`` already).\n\nbloat-o-meter reports a little growth of the code size:\n\nadd/remove: 0/0 grow/shrink: 2/1 up/down: 60/-16 (44)\nFunction                                     old     new   delta\nxskq_cons_peek_desc                          299     330     +31\nxsk_tx_peek_release_desc_batch               973    1002     +29\nxsk_generic_xmit                            3148    3132     -16\n\nbut hopefully this doesn't hurt the performance much.\n\n## Affected\n\n- `Linux >= 341ac980eab90ac1f6c22ee9f9da83ed9604d899 < 1463cd066f32efd56ddfd3ac4e3524200f362980`\n- `Linux >= 341ac980eab90ac1f6c22ee9f9da83ed9604d899 < 5b5fffa7c81e55d8c8edf05ad40d811ec7047e21`\n- `Linux >= 341ac980eab90ac1f6c22ee9f9da83ed9604d899 < 07ca98f906a403637fc5e513a872a50ef1247f3b`\n- `Linux 6.8`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}