CVE-2024-35834

What it actually does

Missing call to xsk_buff_free() in the XSK receive path when __xsk_rcv_zc() cannot produce a descriptor leaves buffers allocated, causing a memory leak under full Rx queue conditions.

Why it matters to the business

Linux systems using AF_XDP sockets can experience gradual memory exhaustion during high network load, leading to degraded performance or crashes in packet processing workloads.

How an attack unfolds

An attacker sends crafted traffic that fills the XSK Rx queue, forcing repeated failure paths in __xsk_rcv_zc() that skip buffer release; over time this depletes kernel memory without requiring code execution.

How to fix it

Apply the upstream fix from commit cce713664548284daf977739e7ff1cd59e84189c or upgrade to a kernel release containing it; rebuild and reboot with the patched kernel image.

How to confirm the fix worked

Confirm presence of the fix by checking kernel source for the added xsk_buff_free() call in the __xsk_rcv_zc() error path or verify running kernel commit hash matches the fixed version.

Typical attack path

1. Establish network connectivity to target system using AF_XDP sockets
2. Generate sustained traffic volume sufficient to saturate the XSK Rx queue
3. Trigger repeated __xsk_rcv_zc() failures to accumulate unfreed buffers
4. Monitor for kernel memory pressure or OOM conditions

How to detect it

Review kernel logs for repeated XSK buffer allocation warnings and track memory usage of processes using AF_XDP; no public exploitation artifacts are known.

What your security team should do

• Prioritize kernel updates on systems exposing AF_XDP sockets to external networks
• Monitor memory usage of XSK-enabled interfaces for unexplained growth
• Test patched kernels in staging before production rollout