Race Condition Vulnerability in Linux Kernel's AF_XDP RX Path
Summary
DEBIAN-CVE-2025-37920: In the Linux kernel, the following vulnerability has been resolved: xsk: Fix race condition in AF_XDP generic RX path Move rx_lock from xsk_socket to xsk_buff_pool. Affects linux versions < 6.12.29-1. Fixed in 6.12.29-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interactions. It is known for its stability, performance, and scalability. The kernel supports various networking protocols and features, including AF_XDP, which allows for high-performance packet processing. However, a recent vulnerability has been identified in the RX path of the AF_XDP implementation, affecting both Debian 13 and 14 versions of the Linux package.
Vulnerability Detail
In the Linux kernel, a race condition was discovered in the AF_XDP generic RX path. This issue arises from the improper synchronization of shared umem mode when multiple sockets share a single xsk_buff_pool. The RX queue is exclusive to each xsk_socket, while the FILL queue can be shared, leading to potential race conditions when two CPU cores access the RX path of different sockets sharing the same umem. The vulnerability could result in data races, impacting the stability and security of applications relying on this functionality.
How To Fix
Minimum fixed version
6.12.29-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to apply the patch as soon as it is available to mitigate any risks associated with the race condition.
Conclusion
The race condition vulnerability in the Linux kernel's AF_XDP RX path poses significant risks to applications using this functionality. It is essential to update to the patched version to ensure system stability and security. Utilizing tools like Vulert can help in monitoring and identifying vulnerabilities in your software.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a race condition in the AF_XDP RX path of the Linux kernel, which can lead to data races when multiple sockets share the same umem.
The vulnerability affects Debian 13 and 14 versions of the Linux package prior to version 6.12.29-1.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If exploited, this vulnerability could lead to instability and security issues in applications that rely on the affected networking features of the Linux kernel.
While there are no specific workarounds mentioned, it is crucial to monitor the system for unusual behavior and apply the patch as soon as it becomes available.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
