CVE-2024-39293

What it actually does

Race condition in AF_XDP/XSK socket handling allows concurrent access to Rx rings by multiple napi instances after removal of queue_index checks, corrupting the flush linked list and causing a crash in __xsk_flush().

Why it matters to the business

Linux systems using AF_XDP sockets for high-performance networking can experience unexpected kernel crashes and service disruption; the issue is fixed in stable kernels released after June 2024 and carries low public exploit probability.

How an attack unfolds

An attacker with local access crafts traffic or socket configurations that cause multiple napi instances to redirect frames to the same AF_XDP socket bound to a shared umem, triggering simultaneous ring modifications that corrupt internal state and crash the kernel on flush.

How to fix it

Upgrade the Linux kernel to version 6.9.5 or later, or apply the revert commit 19cb40b1064566ea09538289bfcf5bc7ecb9b6f5; disable AF_XDP features if immediate patching is not feasible.

How to confirm the fix worked

Verify the running kernel version is 6.9.5 or newer; confirm the revert commit is present in the source tree; test AF_XDP redirect workloads under concurrent napi load to ensure no crashes occur.

Typical attack path

1. Obtain local execution or network access on a vulnerable Linux kernel
2. Create or bind multiple AF_XDP sockets to the same umem
3. Generate traffic that triggers multiple napi instances to redirect to one socket
4. Trigger concurrent ring access that corrupts the flush list
5. Cause kernel panic during __xsk_flush()

How to detect it

Review kernel crash logs and dmesg output for oops or panic messages referencing __xsk_flush, xsk_flush, or AF_XDP ring corruption; correlate with processes using AF_XDP sockets around the time of the crash.

• __xsk_flush
• xsk_flush
• AF_XDP ring corruption
• napi redirect umem

What your security team should do

• Prioritize kernel upgrades on systems exposing AF_XDP sockets to production traffic
• Monitor vendor advisories for distribution-specific backports
• Restrict untrusted local users from creating AF_XDP sockets until patched
• Include kernel version checks in vulnerability scanning pipelines