CVE-2026-74317

ixgbe: do not configure xps for XDP queues

State: Published
Severity: 7.8 High
Published: Aug 15, 2026
Updated: Oct 30, 2026
Reserved: Aug 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ixgbe: do not configure xps for XDP queues

netif_set_xps_queue() should not be called for an XDP Tx queue, since such queues are not netdev-exposed. On systems with number of CPUs >=64, on E610 adapter, netdev is configured with maximum number queue pairs being 63 (due to MSI-X assignment), but configuring XDP results in 64 XDP queues.

So, during XDP program load, when netif_set_xps_queue() is called for the last XDP queue, we get a WARNING with a call trace and KASAN report afterwards (if enabled).

[ 2012.699800] WARNING: net/core/dev.c:2854 at __netif_set_xps_queue+0x116a/0x1e40, CPU#36: xdpsock/103668 [...] [ 2012.700029] RIP: 0010:__netif_set_xps_queue+0x116a/0x1e40 [ 2012.700035] Code: b6 34 06 48 89 f8 83 e0 07 83 c0 01 40 38 f0 7c 09 40 84 f6 0f 85 03 0a 00 00 0f b7 44 24 40 66 43 89 44 6a 18 e9 01 fb ff ff <0f> 0b e9 f2 ee ff ff 44 8b 44 24 44 45 85 c0 74 50 4d 85 e4 0f 84 [ 2012.700040] RSP: 0018:ffff8882369aeb28 EFLAGS: 00010246 [ 2012.700046] RAX: 0000000000000000 RBX: 000000000000003f RCX: 0000000000000000 [ 2012.700050] RDX: 1ffff1111da3d891 RSI: ffff888120e34250 RDI: ffff8888ed1ec488 [ 2012.700054] RBP: ffff888913281560 R08: 0000000000000000 R09: ffff8888ed1ec000 [ 2012.700058] R10: ffff8888a2e83180 R11: 0000000000000000 R12: 0000000000007fa8 [ 2012.700061] R13: 000000000000003f R14: ffff888120e34854 R15: ffff8889132817c8 [ 2012.700065] FS: 00007fc8ea9ff740(0000) GS:ffff88884cefe000(0000) knlGS:0000000000000000 [ 2012.700069] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2012.700073] CR2: 00007f81c8000020 CR3: 00000002299f8006 CR4: 00000000007726f0 [ 2012.700077] PKRU: 55555554 [ 2012.700080] Call Trace: [ 2012.700084] <TASK> [ 2012.700087] ? ktime_get+0x61/0x150 [ 2012.700097] ? usleep_range_state+0x133/0x1b0 [ 2012.700108] ? __pfx_usleep_range_state+0x10/0x10 [ 2012.700114] netif_set_xps_queue+0x31/0x50 [ 2012.700119] ixgbe_configure_tx_ring+0x472/0x920 [ixgbe] [...] [ 2012.700486] ixgbe_xdp+0x38f/0x750 [ixgbe]

[...]

[ 2012.701094] BUG: KASAN: slab-out-of-bounds in __netif_set_xps_queue+0x1ac5/0x1e40 [ 2012.701100] Write of size 4 at addr ffff88888d43cff8 by task xdpsock/103668

Skip XPS configuration for XDP Tx queues.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	33fdc82f08835de4c39a00657742f5b11db00d32 to before 4b7bd53d91155eeb0961f26930f0c70b6538613fAffected 33fdc82f08835de4c39a00657742f5b11db00d32 to before ec485257ccbc787bcde0271d6f649c9018ffb363Affected 33fdc82f08835de4c39a00657742f5b11db00d32 to before 706e811380909a709332136001fe31f37575ef53Affected 33fdc82f08835de4c39a00657742f5b11db00d32 to before f488b83a38103e8eea442cd8fa1a10f982bd60afAffected 33fdc82f08835de4c39a00657742f5b11db00d32 to before a2a224f5e344ccb1ec3693a0735822db9214e2caAffected 33fdc82f08835de4c39a00657742f5b11db00d32 to before 7bd4355272de34c2e90e34b72c5613736d03c32bAffected
LinuxLinux	4.12Affected before 4.12Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.114 through 6.12.Not affected 6.18.57 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

33fdc82f08835de4c39a00657742f5b11db00d32 to before 4b7bd53d91155eeb0961f26930f0c70b6538613fAffected
33fdc82f08835de4c39a00657742f5b11db00d32 to before ec485257ccbc787bcde0271d6f649c9018ffb363Affected
33fdc82f08835de4c39a00657742f5b11db00d32 to before 706e811380909a709332136001fe31f37575ef53Affected
33fdc82f08835de4c39a00657742f5b11db00d32 to before f488b83a38103e8eea442cd8fa1a10f982bd60afAffected
33fdc82f08835de4c39a00657742f5b11db00d32 to before a2a224f5e344ccb1ec3693a0735822db9214e2caAffected
33fdc82f08835de4c39a00657742f5b11db00d32 to before 7bd4355272de34c2e90e34b72c5613736d03c32bAffected

LinuxLinux

4.12Affected
before 4.12Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.114 through 6.12.*Not affected
6.18.57 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.