Technical impact
The vulnerability exists in the Linux kernel’s zero‑copy transmit path. When a transmit request is processed, the kernel validates transmit metadata while holding the descriptor context, then reads the same metadata again later when building the hardware request. The two reads are not synchronised, allowing a user to change the metadata in user space between the initial validation and the subsequent use. This race condition means that unvalidated metadata can end up driving the hardware request, effectively bypassing the kernel’s intended security checks on packet transmission.
Affected Systems
Linux kernel builds that lack the commit that introduces the validation fix are affected. Because no specific version numbers are provided, all kernel releases before the inclusion of the patch are potentially vulnerable. Any distribution shipping an unpatched kernel is therefore impacted.
Risk and Exploitability
The CVSS score of 7.8 indicates high severity. The EPSS <1% suggests that, at the of this assessment, the likelihood of exploitation is low. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that a local user with access to the zero‑copy transmit API can exploit the race condition by modifying the metadata between the initial check and its later use, thereby bypassing validation. The attack requires local user privileges and does not necessitate higher privileges.
Ubuntu USN