CVE-2026-74317 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
ixgbe: do not configure xps for XDP queues
netif_set_xps_queue() should not be called for an XDP Tx queue, since such queues are not netdev-exposed. On systems with number of CPUs >=64, on E610 adapter, netdev is configured with maximum number queue pairs being 63 (due to MSI-X assignment), but configuring XDP results in 64 XDP queues.
So, during XDP program load, when netif_set_xps_queue() is called for the last XDP queue, we get a WARNING with a call trace and KASAN report afterwards (if enabled).
[ 2012.699800] WARNING: net/core/dev.c:2854 at __netif_set_xps_queue+0x116a/0x1e40, CPU#36: xdpsock/103668
[...]
[ 2012.700029] RIP: 0010:__netif_set_xps_queue+0x116a/0x1e40
[ 2012.700035] Code: b6 34 06 48 89 f8 83 e0 07 83 c0 01 40 38 f0 7c 09 40 84 f6 0f 85 03 0a 00 00 0f b7 44 24 40 66 43 89 44 6a 18 e9 01 fb ff ff <0f> 0b e9 f2 ee ff ff 44 8b 44 24 44 45 85 c0 74 50 4d 85 e4 0f 84
[ 2012.700040] RSP: 0018:ffff8882369aeb28 EFLAGS: 00010246
[ 2012.700046] RAX: 0000000000000000 RBX: 000000000000003f RCX: 0000000000000000
[ 2012.700050] RDX: 1ffff1111da3d891 RSI: ffff888120e34250 RDI: ffff8888ed1ec488
[ 2012.700054] RBP: ffff888913281560 R08: 0000000000000000 R09: ffff8888ed1ec000
[ 2012.700058] R10: ffff8888a2e83180 R11: 0000000000000000 R12: 0000000000007fa8
[ 2012.700061] R13: 000000000000003f R14: ffff888120e34854 R15: ffff8889132817c8
[ 2012.700065] FS: 00007fc8ea9ff740(0000) GS:ffff88884cefe000(0000) knlGS:0000000000000000
[ 2012.700069] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 2012.700073] CR2: 00007f81c8000020 CR3: 00000002299f8006 CR4: 00000000007726f0
[ 2012.700077] PKRU: 55555554
[ 2012.700080] Call Trace:
[ 2012.700084] <TASK>
[ 2012.700087] ? ktime_get+0x61/0x150
[ 2012.700097] ? usleep_range_state+0x133/0x1b0
[ 2012.700108] ? __pfx_usleep_range_state+0x10/0x10
[ 2012.700114] netif_set_xps_queue+0x31/0x50
[ 2012.700119] ixgbe_configure_tx_ring+0x472/0x920 [ixgbe]
[...]
[ 2012.700486] ixgbe_xdp+0x38f/0x750 [ixgbe]
[...]
[ 2012.701094] BUG: KASAN: slab-out-of-bounds in __netif_set_xps_queue+0x1ac5/0x1e40
[ 2012.701100] Write of size 4 at addr ffff88888d43cff8 by task xdpsock/103668
Skip XPS configuration for XDP Tx queues.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability resides in the ixgbe network driver within the Linux kernel, specifically concerning the improper handling of XDP (eXpress Data Path) queues during hardware queue configuration. This issue manifests when the driver attempts to configure XPS (Extended Processor Scheduling) for XDP transmission queues that are not exposed through the standard network device interface. The root cause stems from a mismatch between the number of available MSI-X vectors and the total number of XDP queues created, particularly on systems with 64 or more CPUs. When an E610 adapter is configured with maximum queue pairs limited to 63 due to MSI-X constraints, but XDP results in 64 XDP queues, the driver encounters a boundary condition during queue setup operations.
The technical flaw occurs within the ixgbe_configure_tx_ring function where netif_set_xps_queue() is invoked for all XDP Tx queues regardless of their exposure status. XDP queues operate outside the standard network device interface and should not be subject to XPS configuration, yet the driver logic fails to distinguish between regular and XDP queues during this process. This improper handling leads to a kernel warning with a call trace pointing to __netif_set_xps_queue function at address 0x116a/0x1e40, followed by a KASAN (Kernel Address SANitizer) report indicating a slab-out-of-bounds write operation. The memory access violation occurs when attempting to write a 4-byte value to address ffff88888d43cff8 during XDP program loading operations.
The operational impact of this vulnerability extends beyond simple warning messages and can result in system instability and potential denial of service conditions. When the kernel encounters this boundary condition on systems with 64 or more CPUs, the improper XPS configuration attempt triggers kernel panic conditions or system crashes. The vulnerability affects specifically Intel ixgbe network adapters, particularly the E610 model, where the MSI-X vector limitation creates a direct conflict with XDP queue requirements. This issue is particularly concerning in high-performance networking environments where XDP is utilized for packet processing acceleration, as it can prevent proper XDP program loading and execution.
Mitigation strategies must focus on preventing the erroneous XPS configuration for XDP queues through code-level modifications that explicitly check queue types before invoking netif_set_xps_queue(). The solution requires identifying XDP Tx queues and skipping XPS configuration operations for these specific queue types, as indicated by the advisory's recommendation to "Skip XPS configuration for XDP Tx queues." This approach aligns with security best practices outlined in CWE-129, which addresses improper validation of array indices, and follows ATT&CK techniques related to privilege escalation through kernel exploits. Organizations should ensure their ixgbe drivers are updated to versions that implement this fix, particularly in production environments where high CPU counts and XDP usage are common. The vulnerability also highlights the importance of proper queue management and resource allocation in kernel network subsystems, emphasizing the need for robust validation of hardware resource constraints against software configuration requirements.