CVE-2024-27431

cpumap: Zero-initialise xdp_rxq_info struct before running XDP program

State: Published
Severity: 7.8 High
Published: May 17, 2024
Updated: Oct 15, 2026
Reserved: Feb 25, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

cpumap: Zero-initialise xdp_rxq_info struct before running XDP program

When running an XDP program that is attached to a cpumap entry, we don't initialise the xdp_rxq_info data structure being used in the xdp_buff that backs the XDP program invocation. Tobias noticed that this leads to random values being returned as the xdp_md->rx_queue_index value for XDP programs running in a cpumap.

This means we're basically returning the contents of the uninitialised memory, which is bad. Fix this by zero-initialising the rxq data structure before running the XDP program.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-908 Use of Uninitialized Resource

Affected Products

Product	Versions
LinuxLinux	9216477449f33cdbc9c9a99d49f500b7fbb81702 to before 5f4e51abfbe6eb444fa91906a5cd083044278297Affected 9216477449f33cdbc9c9a99d49f500b7fbb81702 to before f0363af9619c77730764f10360e36c6445c12f7bAffected 9216477449f33cdbc9c9a99d49f500b7fbb81702 to before 3420b3ff1ff489c177ea1cb7bd9fbbc4e9a0be95Affected 9216477449f33cdbc9c9a99d49f500b7fbb81702 to before f562e4c4aab00986dde3093c4be919c3f2b85a4aAffected 9216477449f33cdbc9c9a99d49f500b7fbb81702 to before eaa7cb836659ced2d9f814ac32aa3ec193803ed6Affected 9216477449f33cdbc9c9a99d49f500b7fbb81702 to before 2487007aa3b9fafbd2cb14068f49791ce1d7ede5Affected
LinuxLinux	5.9Affected before 5.9Not affected 5.10.213 through 5.10.Not affected 5.15.152 through 5.15.Not affected 6.1.82 through 6.1.Not affected 6.6.22 through 6.6.Not affected 6.7.10 through 6.7.*Not affected 6.8 and laterNot affected

Product

Versions

LinuxLinux

9216477449f33cdbc9c9a99d49f500b7fbb81702 to before 5f4e51abfbe6eb444fa91906a5cd083044278297Affected
9216477449f33cdbc9c9a99d49f500b7fbb81702 to before f0363af9619c77730764f10360e36c6445c12f7bAffected
9216477449f33cdbc9c9a99d49f500b7fbb81702 to before 3420b3ff1ff489c177ea1cb7bd9fbbc4e9a0be95Affected
9216477449f33cdbc9c9a99d49f500b7fbb81702 to before f562e4c4aab00986dde3093c4be919c3f2b85a4aAffected
9216477449f33cdbc9c9a99d49f500b7fbb81702 to before eaa7cb836659ced2d9f814ac32aa3ec193803ed6Affected
9216477449f33cdbc9c9a99d49f500b7fbb81702 to before 2487007aa3b9fafbd2cb14068f49791ce1d7ede5Affected

LinuxLinux

5.9Affected
before 5.9Not affected
5.10.213 through 5.10.*Not affected
5.15.152 through 5.15.*Not affected
6.1.82 through 6.1.*Not affected
6.6.22 through 6.6.*Not affected
6.7.10 through 6.7.*Not affected
6.8 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.