A race condition in the Linux kernel’s AF_XDP socket handling allows a malicious userspace program to overwrite certain checksum metadata fields between two reads, bypassing bounds checks and causing the kernel to perform an out‑of‑bounds memory access during checksum computation. The resulting out‑of‑bounds access can corrupt kernel memory or crash the system.

All Linux kernel installations that expose the AF_XDP socket interface and use the default snapshot of the code before the patch that caches csum_start and csum_offset locally are affected. The vulnerability is present in the kernel source tree; thus any distribution building from that source without the patch is vulnerable.

The defect is a local race condition; the attacker must run a userspace process that can create an AF_XDP socket and map the UMEM buffer. The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1% suggests a very low yet non‑zero likelihood of exploitation. The flaw is not listed in CISA’s KEV catalog. A successful exploit can lead to kernel memory corruption or a denial of service, making it a high‑risk vulnerability.