Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-90115— xsk: fix NULL pointer dereference in __xsk_rcv()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，已解决以下漏洞： xsk：修复 中的空指针解引用问题 在 的多缓冲区路径中，代码在一个循环中调用 ，但未检查其返回值。 仅统计填充队列中的条目数量，而未验证这些条目的地址，因此即使所有剩余条目都无法分配内存并返回 ， 仍可能返回成功。 错误现场： 修复方案：采用两阶段事务机制。第一阶段，先为数据包分配并暂存所有必需的缓冲区；如果任何一次分配失败，则通过 回收所有已暂存的缓冲区。只有当该阶段完全成功后，才执行数据复制、预留接收描述符，并在无错误的循环中释放缓冲区。

AI Predicted 5.5 Difficulty: Hard

Possible ATT&CK Techniques 1 AI

T1203 · Exploitation for Client Execution

Affected Version Matrix 12

VendorProduct Version RangeStatus
Linux Linux 804627751b4281dd95148e7564759145da67855e< aaebce297efc3e3dccb98a6ff838cfaa47db08db affected
804627751b4281dd95148e7564759145da67855e< 60d7d3559ce66e227e195e9463cdfed8077c8659 affected
804627751b4281dd95148e7564759145da67855e< 214fb79b0379cb0214905632a2537c0c33f594eb affected
804627751b4281dd95148e7564759145da67855e< 8341bd3ff126d85bc8c4ed52eedcaa5b1a65f194 affected
804627751b4281dd95148e7564759145da67855e< e37b2abca80473e106176e41712a369fd2f72117 affected
6.6 affected
< 6.6 unaffected
6.6.157≤ 6.6.* unaffected
… +4 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-90115

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
xsk: fix NULL pointer dereference in __xsk_rcv()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: xsk: fix NULL pointer dereference in __xsk_rcv() In the __xsk_rcv() multi-buffer path, xsk_buff_alloc() is called in a loop without checking its return value. xsk_buff_can_alloc() only counts fill queue entries without validating their addresses, so it can succeed while xsk_buff_alloc() rejects all remaining entries and returns NULL. Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000 KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:__xsk_rcv+0x426/0xc20 (net/xdp/xsk.c:350) Call Trace: xsk_generic_rcv+0x26d/0x5f0 xdp_do_generic_redirect+0x3c5/0xcf0 do_xdp_generic+0x92f/0xe70 __netif_receive_skb_core.constprop.0+0xf7e/0x2b30 Fix this with a two-stage transaction. First allocate and stage all buffers required for the packet, recycling all staged buffers with xsk_buff_free() if any allocation fails. Only after this stage succeeds, copy the data, reserve the RX descriptors, and release the buffers in an error-free loop.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 804627751b4281dd95148e7564759145da67855e ~ aaebce297efc3e3dccb98a6ff838cfaa47db08db -
Linux Linux 6.6 -

II. Public POCs for CVE-2026-90115

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-90115

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-90115 (5)

Same Patch Batch · Linux · 2026-09-17 · 602 CVEs total

CVE-2026-90257 Bluetooth: virtio_bt: avoid OOB read of build info string
CVE-2026-90240 iommu/vt-d: Flush context cache with correct SID when tearing down aliases
CVE-2026-90239 media: amd: isp4: release partial allocations in isp4if_alloc_fw_gpumem()
CVE-2026-90241 iommu/vt-d: Tear down scalable-mode context on probe failure
CVE-2026-90243 iommu/vt-d: Clear Present bit before tearing down copied context entry
CVE-2026-90242 iommu/vt-d: Fix iopf_refcount leak on RID domain replacement
CVE-2026-90244 iommu/dma: Restore locking around msi_page_list
CVE-2026-90245 fbdev: kyro: Validate overlay viewport coordinates
CVE-2026-90246 apparmor: fix integer overflow in verify_tags() bounds check
CVE-2026-90247 bpf: Fix mmap_lock leak in irq_work path
CVE-2026-90248 net/sched: cls_api: fix teardown of an adopted proto on insert-race loss
CVE-2026-90249 iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes
CVE-2026-90250 bpf, cgroup: Fix storage null-ptr-deref after replacing prog
CVE-2026-90251 Bluetooth: MSFT: validate evt_prefix_len against the response length
CVE-2026-90253 Bluetooth: MGMT: free the mesh send cancel command when it is cancelled
CVE-2026-90252 Bluetooth: MGMT: free the HCI command when it is cancelled
CVE-2026-90254 Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths
CVE-2026-90256 Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind
CVE-2026-90255 Bluetooth: hci_conn: fix the SCO setup context lifetime
CVE-2026-90267 scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails

Showing top 20 of 602 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-90115

No comments yet

Leave a comment