The Linux kernel contains a flaw in the transmit path for AF_XDP sockets that can be triggered when a packet is too large—exceeding the maximum number of descriptors—or when an invalid descriptor is part of a fragmented packet. In this situation the kernel stops draining descriptors from the AF_XDP transmit ring; those descriptors are silently lost and never become available again. This results in the loss of transmitted packets, which undermines reliable network communication and can degrade application performance.

All Linux kernel releases that incorporate the AF_XDP socket implementation prior to the commit that introduced the xdp_sock::drain_cont flag (e.g., commit 5e94d74e4f3baebaa083288f33b4be7ce0a34982). The affected product is the Linux kernel; no specific version numbers are provided, so any kernel build before this patch is potentially vulnerable.

The CVSS score of 5.5 indicates a medium severity vulnerability. The EPSS score of less than 1% signals a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local or privileged: a user or application that can send malformed packets to an AF_XDP socket could trigger the condition that causes descriptor loss. This assessment is inferred from the nature of the flaw, as the description does not explicitly state the vector.