CVE-2026-43092: Linux Kernel AF_XDP DoS Vulnerability

CVE-2026-43092 Overview

CVE-2026-43092 is a Linux kernel vulnerability in the AF_XDP (Address Family eXpress Data Path) subsystem. The kernel's xsk (XDP socket) implementation accepts zero-copy pool configurations during bind() without validating that the device Maximum Transmission Unit (MTU) fits within the usable frame space provided by the User Memory (UMEM) chunk. After the kernel began respecting tailroom subtracted from chunk_size, a 2K chunk size may no longer accommodate a standard 1500-byte MTU, leading to inconsistent frame handling. The fix introduces validation at bind time and verifies hardware capability via net_device::xdp_zc_max_segs.

Critical Impact
Misconfigured AF_XDP zero-copy sockets can produce undefined frame handling on the receive path, affecting kernel networking stability for high-performance packet processing workloads.

Affected Products

Linux kernel (mainline) versions implementing tailroom-aware AF_XDP zero-copy chunk sizing
Distributions shipping affected stable kernel branches
Networking workloads using AF_XDP zero-copy with UMEM chunk sizes near MTU thresholds

Discovery Timeline

2026-05-06 - CVE-2026-43092 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43092

Vulnerability Analysis

AF_XDP enables user space applications to send and receive packets directly via shared memory regions called UMEMs. UMEMs are divided into fixed-size chunks. When bind() is invoked on an AF_XDP socket configured for zero-copy mode, the kernel pairs the UMEM with a device queue.

Before the patch, the bind path did not check whether the usable per-frame space — chunk_size minus headroom and tailroom — could hold a packet sized to the device MTU. After the kernel began respecting tailroom, a 2048-byte chunk no longer guarantees space for a 1500-byte MTU plus reserved regions. The mismatch produces inconsistent receive behavior on zero-copy paths.

A related gap involves multi-buffer Rx. Hardware advertises its supported receive buffer chain length via net_device::xdp_zc_max_segs. The bind path did not verify that MTU fits within frame_size * xdp_zc_max_segs, allowing configurations the underlying NIC cannot satisfy.

Root Cause

The root cause is missing input validation in the xsk bind logic. The kernel accepted UMEM and MTU combinations that violate the post-tailroom usable frame size invariant. This is an Improper Input Validation flaw in the kernel networking stack [CWE-20].

Attack Vector

Triggering the condition requires local privileges sufficient to create AF_XDP sockets and bind them with custom UMEM configurations. The issue manifests through misconfiguration rather than a remotely reachable attack surface, so impact is limited to systems where untrusted local users can configure AF_XDP zero-copy sockets.

The vulnerability is described in commits referenced by the upstream stable tree, including Kernel Git Commit 25e1e91, Kernel Git Commit 36ee60b, Kernel Git Commit a55793e, Kernel Git Commit b2f4daa, and Kernel Git Commit f669d60.

No public proof-of-concept code is available, and no synthetic exploitation example is included here.

Detection Methods for CVE-2026-43092

Indicators of Compromise

No specific runtime indicators are documented for this validation flaw because it affects bind-time configuration rather than producing a known artifact.
Unexpected bind() failures returning -EINVAL after patching may indicate previously misconfigured AF_XDP applications.
Networking stack warnings or unusual packet drops on interfaces configured with AF_XDP zero-copy sockets.

Detection Strategies

Inventory hosts running kernels that include tailroom-aware chunk sizing but lack the validation patches referenced above.
Audit user space applications using AF_XDP zero-copy with XDP_USE_NEED_WAKEUP or XSK_UMEM__DEFAULT_FRAME_SIZE of 2048 against interfaces with 1500-byte MTU.
Correlate kernel version data from configuration management with the upstream commit list to identify unpatched systems.

Monitoring Recommendations

Track bind() syscall outcomes for processes opening AF_XDP sockets and alert on configuration anomalies.
Monitor network interface counters for malformed or truncated frames on devices used by XDP applications.
Maintain visibility into kernel module and kernel package version drift across the fleet.

How to Mitigate CVE-2026-43092

Immediate Actions Required

Apply the upstream Linux kernel stable updates that include the xsk: validate MTU against usable frame size on bind fix.
Identify AF_XDP zero-copy workloads and verify that chunk_size minus headroom and tailroom is greater than or equal to the device MTU.
Where chunk size cannot be increased, reduce the interface MTU to fit the available frame space until patches are deployed.

Patch Information

The fix is distributed across multiple stable branches via the following commits: 25e1e91, 36ee60b, a55793e, b2f4daa, and f669d60. Pull the kernel package update from your distribution maintainer that incorporates these commits and reboot affected hosts.

Workarounds

Increase UMEM chunk_size (for example, from 2048 to 4096 bytes) to ensure usable frame space exceeds the configured MTU.
Lower the device MTU on interfaces bound by AF_XDP zero-copy sockets to fit within chunk_size minus headroom and tailroom.
Restrict the CAP_NET_ADMIN and CAP_NET_RAW capabilities required for AF_XDP socket creation to trusted service accounts only.

bash

# Configuration example: align MTU with available XSK frame space
# Inspect current MTU
ip link show dev eth0

# Reduce MTU on the interface used by the AF_XDP application
sudo ip link set dev eth0 mtu 1400

# Verify hardware-supported zero-copy segment count
cat /sys/class/net/eth0/device/xdp_zc_max_segs 2>/dev/null || \
  ethtool -i eth0