This vulnerability in the Linux kernel's AF_XDP socket implementation involves improper validation of the xdp_desc structure supplied by userspace. The validation functions xp_{,un}aligned_validate_desc() can be bypassed by certain invalid desc->len and desc->addr values that cause integer overflow or underflow, leading to undefined behavior or invalid frames being transmitted. The root cause is the use of 32-bit arithmetic without proper promotion to 64-bit or explicit overflow checks. The patch promotes desc->len to u64 and uses explicit overflow detection for desc->addr to prevent these bypasses. The vulnerability is rated high severity (CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No known exploits in the wild are reported. No specific affected versions are provided in the data.

Successful exploitation could allow a local attacker with low privileges to cause undefined behavior in the kernel or transmit invalid network frames, potentially leading to denial of service or other impacts on confidentiality, integrity, and availability. The CVSS vector indicates high impact on confidentiality, integrity, and availability, but exploitation requires local access with low privileges and no user interaction.

A fix has been implemented in the Linux kernel to harden validation of xdp_desc structures by promoting desc->len to 64-bit and adding explicit overflow checks for desc->addr. Users should update to the latest Linux kernel version containing this fix once available. Patch status is not explicitly confirmed in the provided data; therefore, check the official Linux kernel advisories or vendor sources for the exact fixed versions and apply updates accordingly.