Linux Kernel CVE-2025-40159

In the Linux kernel, the following vulnerability has been resolved:

xsk: Harden userspace-supplied xdp_desc validation

Turned out certain clearly invalid values passed in xdp_desc from userspace can pass xp_{,un}aligned_validate_desc() and then lead to UBs or just invalid frames to be queued for xmit.

desc->len close to `U32_MAX` with a non-zero pool->tx_metadata_len can cause positive integer overflow and wraparound, the same way low enough desc->addr with a non-zero pool->tx_metadata_len can cause negative integer overflow. Both scenarios can then pass the validation successfully. This doesn't happen with valid XSk applications, but can be used to perform attacks.

Always promote desc->len to `u64 first to exclude positive overflows of it. Use explicit check_{add,sub}_overflow() when validating desc->addr (which is u64` already).

bloat-o-meter reports a little growth of the code size:

add/remove: 0/0 grow/shrink: 2/1 up/down: 60/-16 (44) Function old new delta xskq_cons_peek_desc 299 330 +31 xsk_tx_peek_release_desc_batch 973 1002 +29 xsk_generic_xmit 3148 3132 -16

but hopefully this doesn't hurt the performance much.

The Linux kernel's XSK/AF_XDP subsystem (net/xdp) is affected across versions that include tx_metadata_len handling in the descriptor validation path; NVD did not publish specific CPE version ranges in the provided data, and the fix is tracked via three stable-tree commits (07ca98f906a4, 1463cd066f32, 5b5fffa7c81e at git.kernel.org). Distribution-specific fixed builds are enumerated in Ubuntu's advisories USN-8125-1 (https://ubuntu.com/security/notices/USN-8125-1) and USN-8126-1 (https://ubuntu.com/security/notices/USN-8126-1). Administrators should map their running kernel version against their distribution's advisory rather than relying on a single upstream version number, since backports vary by stable branch.