Linux Kernel CVE-2026-90142

Requires: (1) the guest/host using the virtio_net driver; (2) an AF_XDP socket attached in zero-copy mode ('-z') to a specific RX queue; and (3) the attacker growing the RX ring size (ethtool -G rx <larger>) while that socket is attached, so virtnet_rx_resume() writes beyond the un-resized rq->xsk_buffs array. Limiting factors: local access only (AV:L), CAP_NET_ADMIN privilege needed to both bind the XSK socket and resize the ring (PR:L), no remote or unauthenticated vector, and the AF_XDP zero-copy resize path is a non-default operational configuration rather than an out-of-the-box exposure.

The vendor CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8 High) is broadly credible for a heap out-of-bounds write, but the real-world priority is moderated by strong gating conditions not reflected in the raw score. The flaw is a deterministic (not race-based) write past the end of the rq->xsk_buffs array, so AC:L is justified, and PR:L is correct because both attaching an AF_XDP zero-copy socket and issuing ethtool ring-resize require CAP_NET_ADMIN. There is no EPSS score, no CISA KEV listing, and no SSVC decision data provided; exploitation status is no public exploit identified at time of analysis, though the description embeds a working functional reproducer (ethtool -G plus xdpsock), which lowers the research barrier for weaponization. Note two data conflicts: the input Tag 'Information Disclosure' contradicts the description, which clearly describes a memory-corruption OOB WRITE (integrity/availability), not a read/disclosure; and the CWE is absent though the description maps cleanly to CWE-787. This is a legitimate local privilege-escalation-class memory-corruption bug for hosts running the affected config, but it is a targeted/local issue rather than a mass-exploitable network threat.

A local user with CAP_NET_ADMIN on a Linux guest using the virtio_net NIC binds an AF_XDP zero-copy socket to an RX queue, then grows the RX ring with ethtool (e.g. from 32 to 256). The resume path writes XSK buffer entries past the end of the undersized rq->xsk_buffs array, corrupting adjacent heap memory, which can be shaped toward privilege escalation or a kernel crash. No public exploit code is listed, but the CVE description itself contains a step-by-step reproducer.