GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-35834 (GCVE-0-2024-35834)

Vulnerability from cvelistv5 – Published: 2024-05-17 14:02 – Updated: 2026-08-05 11:30
VLAI
Title
xsk: recycle buffer in case Rx queue was full
Summary
In the Linux kernel, the following vulnerability has been resolved: xsk: recycle buffer in case Rx queue was full Add missing xsk_buff_free() call when __xsk_rcv_zc() failed to produce descriptor to XSK Rx queue.
Severity
8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-12 15:14 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 24ea50127ecf0efe819c1f6230add27abc6ca9d9 , < cce713664548284daf977739e7ff1cd59e84189c (git)
Affected: 24ea50127ecf0efe819c1f6230add27abc6ca9d9 , < 7b4d93d31aade99210d41cd9d4cbd2957c98bc8c (git)
Affected: 24ea50127ecf0efe819c1f6230add27abc6ca9d9 , < 269009893146c495f41e9572dd9319e787c2eba9 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.6
Unaffected: 0 , < 6.6 (semver)
Unaffected: 6.6.15 , ≤ 6.6.* (semver)
Unaffected: 6.7.3 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-35834",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-12T15:14:57.887303Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-12T15:15:08.082Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:48.585Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/cce713664548284daf977739e7ff1cd59e84189c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7b4d93d31aade99210d41cd9d4cbd2957c98bc8c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/269009893146c495f41e9572dd9319e787c2eba9"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/xdp/xsk.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cce713664548284daf977739e7ff1cd59e84189c",
              "status": "affected",
              "version": "24ea50127ecf0efe819c1f6230add27abc6ca9d9",
              "versionType": "git"
            },
            {
              "lessThan": "7b4d93d31aade99210d41cd9d4cbd2957c98bc8c",
              "status": "affected",
              "version": "24ea50127ecf0efe819c1f6230add27abc6ca9d9",
              "versionType": "git"
            },
            {
              "lessThan": "269009893146c495f41e9572dd9319e787c2eba9",
              "status": "affected",
              "version": "24ea50127ecf0efe819c1f6230add27abc6ca9d9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/xdp/xsk.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.15",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.15",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.3",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: recycle buffer in case Rx queue was full\n\nAdd missing xsk_buff_free() call when __xsk_rcv_zc() failed to produce\ndescriptor to XSK Rx queue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The trigger condition \u2014 the AF_XDP Rx ring becoming full in `__xsk_rcv_zc()` \u2014 is produced purely by inbound network packets arriving faster than the userspace application drains the ring, so a remote attacker flooding the NIC bound to the zero-copy socket reaches the vulnerable path with no local access. AF_XDP zero-copy data planes (cloud load balancers, 5G UPF, DPDK-style userspace networking) are by definition internet-facing.\nAC:L - The attacker fully controls the trigger by sending traffic faster than the application consumes it; there is no race to win and no memory-layout dependency, and `XDP_USE_NEED_WAKEUP` (which makes the ice/i40e drivers take the `XDP_EXIT` path that also skips the free) is the libbpf/xdpsock default. Every `-ENOBUFS` event leaks a buffer, so a flood drains the fixed-size umem pool deterministically.\nPR:N - No credentials or local account are needed \u2014 the attacker only has to send packets to the interface, and the entire path runs in the driver NAPI/XDP receive context before any authentication or authorization exists.\nUI:N - The leak occurs automatically during packet reception in the driver\u0027s NAPI poll; no action by any local user or administrator is required beyond the AF_XDP application already running.\nS:U - The leaked buffers and the resulting resource exhaustion are confined to the kernel\u0027s XSK buffer pool and the host\u0027s network stack, with no crossing into a hypervisor, IOMMU, or other security authority.\nC:N - There is no out-of-bounds read, uninitialized-memory read, or use-after-free; the stale `xskb_list` fragments that get mis-delivered contain packet data that was already destined for that same socket\u0027s umem, so no kernel memory or cross-boundary data is disclosed.\nI:L - Fragments left on the shared `pool-\u003exskb_list` are produced as descriptors for a subsequent, unrelated frame, and the already-reserved `XDP_PKT_CONTD` descriptors desynchronize reassembly, so the attacker can cause corrupted, mis-assembled packet data to be delivered to the userspace application. This is bounded data corruption on the receive path, not an arbitrary write or control-flow hijack.\nA:H - Each Rx-full event permanently removes a chunk from the fixed-size, non-replenishable XSK buffer pool; a sustained flood drains it entirely, after which `xp_alloc_batch()` returns nothing, the Rx ring cannot be refilled, and packet reception on that queue ceases while `ice_clean_rx_irq_zc()` keeps returning `budget` and re-arming NAPI. This is a complete, non-self-healing denial of service of the network data path requiring an application restart to recover."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:30:12.321Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cce713664548284daf977739e7ff1cd59e84189c"
        },
        {
          "url": "https://git.kernel.org/stable/c/7b4d93d31aade99210d41cd9d4cbd2957c98bc8c"
        },
        {
          "url": "https://git.kernel.org/stable/c/269009893146c495f41e9572dd9319e787c2eba9"
        }
      ],
      "title": "xsk: recycle buffer in case Rx queue was full",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35834",
    "datePublished": "2024-05-17T14:02:19.184Z",
    "dateReserved": "2024-05-17T13:50:33.103Z",
    "dateUpdated": "2026-08-05T11:30:12.321Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-35834",
      "date": "2026-09-20",
      "epss": "0.00411",
      "percentile": "0.35076"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: recycle buffer in case Rx queue was full\n\nAdd missing xsk_buff_free() call when __xsk_rcv_zc() failed to produce\ndescriptor to XSK Rx queue."
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: xsk: reciclar b\u00fafer en caso de que la cola Rx estuviera llena. Agregue la llamada xsk_buff_free() faltante cuando __xsk_rcv_zc() falla al generar un descriptor en la cola XSK Rx."
        }
      ],
      "id": "CVE-2024-35834",
      "lastModified": "2024-11-21T09:21:00.387",
      "published": "2024-05-17T14:15:20.160",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/269009893146c495f41e9572dd9319e787c2eba9"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/7b4d93d31aade99210d41cd9d4cbd2957c98bc8c"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/cce713664548284daf977739e7ff1cd59e84189c"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/269009893146c495f41e9572dd9319e787c2eba9"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/7b4d93d31aade99210d41cd9d4cbd2957c98bc8c"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/cce713664548284daf977739e7ff1cd59e84189c"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/xdp/xsk.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "cce713664548284daf977739e7ff1cd59e84189c",
                    "status": "affected",
                    "version": "24ea50127ecf0efe819c1f6230add27abc6ca9d9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7b4d93d31aade99210d41cd9d4cbd2957c98bc8c",
                    "status": "affected",
                    "version": "24ea50127ecf0efe819c1f6230add27abc6ca9d9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "269009893146c495f41e9572dd9319e787c2eba9",
                    "status": "affected",
                    "version": "24ea50127ecf0efe819c1f6230add27abc6ca9d9",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/xdp/xsk.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.6"
                  },
                  {
                    "lessThan": "6.6",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.15",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.7.*",
                    "status": "unaffected",
                    "version": "6.7.3",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.8",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EB070897-9C4B-4820-AE94-31318C9F5D76",
                    "versionEndExcluding": "6.6.15",
                    "versionStartIncluding": "6.6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "58FD5308-148A-40D3-B36A-0CA6B434A8BF",
                    "versionEndExcluding": "6.7.3",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "B9F4EA73-0894-400F-A490-3A397AB7A517",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: recycle buffer in case Rx queue was full\n\nAdd missing xsk_buff_free() call when __xsk_rcv_zc() failed to produce\ndescriptor to XSK Rx queue."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: xsk: reciclar b\u00fafer en caso de que la cola Rx estuviera llena. Agregue la llamada xsk_buff_free() faltante cuando __xsk_rcv_zc() falla al generar un descriptor en la cola XSK Rx."
          }
        ],
        "id": "CVE-2024-35834",
        "lastModified": "2026-08-04T11:17:57.270",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 4.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-35834",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-12T15:14:57.887303Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-05-17T14:15:20.160",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/269009893146c495f41e9572dd9319e787c2eba9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/7b4d93d31aade99210d41cd9d4cbd2957c98bc8c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/cce713664548284daf977739e7ff1cd59e84189c"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/269009893146c495f41e9572dd9319e787c2eba9"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/7b4d93d31aade99210d41cd9d4cbd2957c98bc8c"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/cce713664548284daf977739e7ff1cd59e84189c"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-401"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:47:19+00:00",
      "cve": "CVE-2024-35834",
      "id": "CVE-2024-35834",
      "initial_release_date": "2024-05-17T00:00:00+00:00",
      "product_status:known_affected": "108",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: xsk: recycle buffer in case Rx queue was full",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-35834.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-30T02:38:22Z",
      "cve": "CVE-2024-35834",
      "id": "CVE-2024-35834",
      "initial_release_date": "2024-05-21T02:00:00Z",
      "product_status:known_not_affected": "332",
      "product_status:recommended": "357",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-35834",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-35834.json",
      "version": "68"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T03:21:48.585Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/cce713664548284daf977739e7ff1cd59e84189c"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/7b4d93d31aade99210d41cd9d4cbd2957c98bc8c"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/269009893146c495f41e9572dd9319e787c2eba9"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-35834",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-06-12T15:14:57.887303Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-06-12T15:15:04.464Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "net/xdp/xsk.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "cce713664548284daf977739e7ff1cd59e84189c",
                  "status": "affected",
                  "version": "24ea50127ecf0efe819c1f6230add27abc6ca9d9",
                  "versionType": "git"
                },
                {
                  "lessThan": "7b4d93d31aade99210d41cd9d4cbd2957c98bc8c",
                  "status": "affected",
                  "version": "24ea50127ecf0efe819c1f6230add27abc6ca9d9",
                  "versionType": "git"
                },
                {
                  "lessThan": "269009893146c495f41e9572dd9319e787c2eba9",
                  "status": "affected",
                  "version": "24ea50127ecf0efe819c1f6230add27abc6ca9d9",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "net/xdp/xsk.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "6.6"
                },
                {
                  "lessThan": "6.6",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.15",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.7.*",
                  "status": "unaffected",
                  "version": "6.7.3",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.8",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.15",
                      "versionStartIncluding": "6.6",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.7.3",
                      "versionStartIncluding": "6.6",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.8",
                      "versionStartIncluding": "6.6",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: recycle buffer in case Rx queue was full\n\nAdd missing xsk_buff_free() call when __xsk_rcv_zc() failed to produce\ndescriptor to XSK Rx queue."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:N - The trigger condition \u2014 the AF_XDP Rx ring becoming full in `__xsk_rcv_zc()` \u2014 is produced purely by inbound network packets arriving faster than the userspace application drains the ring, so a remote attacker flooding the NIC bound to the zero-copy socket reaches the vulnerable path with no local access. AF_XDP zero-copy data planes (cloud load balancers, 5G UPF, DPDK-style userspace networking) are by definition internet-facing.\nAC:L - The attacker fully controls the trigger by sending traffic faster than the application consumes it; there is no race to win and no memory-layout dependency, and `XDP_USE_NEED_WAKEUP` (which makes the ice/i40e drivers take the `XDP_EXIT` path that also skips the free) is the libbpf/xdpsock default. Every `-ENOBUFS` event leaks a buffer, so a flood drains the fixed-size umem pool deterministically.\nPR:N - No credentials or local account are needed \u2014 the attacker only has to send packets to the interface, and the entire path runs in the driver NAPI/XDP receive context before any authentication or authorization exists.\nUI:N - The leak occurs automatically during packet reception in the driver\u0027s NAPI poll; no action by any local user or administrator is required beyond the AF_XDP application already running.\nS:U - The leaked buffers and the resulting resource exhaustion are confined to the kernel\u0027s XSK buffer pool and the host\u0027s network stack, with no crossing into a hypervisor, IOMMU, or other security authority.\nC:N - There is no out-of-bounds read, uninitialized-memory read, or use-after-free; the stale `xskb_list` fragments that get mis-delivered contain packet data that was already destined for that same socket\u0027s umem, so no kernel memory or cross-boundary data is disclosed.\nI:L - Fragments left on the shared `pool-\u003exskb_list` are produced as descriptors for a subsequent, unrelated frame, and the already-reserved `XDP_PKT_CONTD` descriptors desynchronize reassembly, so the attacker can cause corrupted, mis-assembled packet data to be delivered to the userspace application. This is bounded data corruption on the receive path, not an arbitrary write or control-flow hijack.\nA:H - Each Rx-full event permanently removes a chunk from the fixed-size, non-replenishable XSK buffer pool; a sustained flood drains it entirely, after which `xp_alloc_batch()` returns nothing, the Rx ring cannot be refilled, and packet reception on that queue ceases while `ice_clean_rx_irq_zc()` keeps returning `budget` and re-arming NAPI. This is a complete, non-self-healing denial of service of the network data path requiring an application restart to recover."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T11:30:12.321Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/cce713664548284daf977739e7ff1cd59e84189c"
            },
            {
              "url": "https://git.kernel.org/stable/c/7b4d93d31aade99210d41cd9d4cbd2957c98bc8c"
            },
            {
              "url": "https://git.kernel.org/stable/c/269009893146c495f41e9572dd9319e787c2eba9"
            }
          ],
          "title": "xsk: recycle buffer in case Rx queue was full",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-35834",
        "datePublished": "2024-05-17T14:02:19.184Z",
        "dateReserved": "2024-05-17T13:50:33.103Z",
        "dateUpdated": "2026-08-05T11:30:12.321Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.