CVE-2024-26611 in Linux
Zusammenfassung
von VulDB • 30.05.2026
This is a kernel bug report and patch description related to the Linux kernel's XDP (eXpress Data Path) subsystem, specifically involving the `ice` network driver and XDP sockets (XSK).
### Analysis of the Bug
1. **Crash Type**: Page Fault (`CR2: 0000000000000034` indicates an invalid memory access at address `0x34`). 2. **Trigger**: The crash occurs in `__xdp_return()` when it is called with a `NULL` `xdp_buff` pointer. 3. **Call Chain**: * `ice_napi_poll` (NAPI poll function for Intel Ice driver) * `ice_clean_rx_irq_zc` (Zero-Copy RX cleanup) * `bpf_prog_ccc47ae29d3b6570_xdp_sock_prog` (BPF program attached to XDP socket) * `bpf_xdp_adjust_tail` (BPF helper to adjust packet tail pointer) * `__xdp_return` (Returns the XDP buffer) 4. **Root Cause**: In Zero-Copy (ZC) mode, when `bpf_xdp_adjust_tail` is called, it modifies the packet structure. However, the underlying `xsk_buff` (which manages the memory for XDP sockets) is not properly updated or removed from its internal list (`xskb_list`) before the buffer is returned. This leads to `__xdp_return` receiving a corrupted or NULL state, causing a NULL pointer dereference or invalid memory access.
### Proposed Fix
The patch introduces helpers to properly manage the `xskb_list` in Zero-Copy mode:
1. **Introduce XSK Helpers**: New functions are added to safely remove a node representing a fragment from the `xskb_list`. 2. **Update `bpf_xdp_adjust_tail`**: When adjusting the tail pointer in ZC mode, the code now ensures that the corresponding node is pulled out of the `xskb_list` before returning the buffer. This prevents the `__xdp_return` from being called with an inconsistent state.
### Key Code Changes (Conceptual)
```c // New helper to remove a node from xskb_list void xsk_buff_remove_node(struct xsk_buff *xskb, struct list_head *node);
// In bpf_xdp_adjust_tail() if (is_zc_mode) {
// Remove the fragment node from the list before adjusting tail xsk_buff_remove_node(xskb, &frag_node); } // ... proceed with tail adjustment ... ```
### Impact
- **Stability**: Prevents kernel crashes when using XDP sockets with zero-copy mode and BPF programs that adjust packet tails. - **Correctness**: Ensures proper memory management for XDP sockets in ZC mode.
### Recommendation
Apply the patch that introduces the `xsk_buff_remove_node` helper and updates `bpf_xdp_adjust_tail` to use it in Zero-Copy mode. This is critical for systems relying on high-performance XDP processing with Intel Ice drivers.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.