Linux kernel ixgbe: XPS setup on XDP Tx queues writes out of bounds on high-core-count hosts

Impact

ixgbe called netif_set_xps_queue() for XDP Tx queues, which are not exposed to the netdev. On a host with 64 or more CPUs using an E610 adapter, MSI-X assignment caps the netdev at 63 queue pairs while XDP allocates 64, so configuring an XDP program drives a WARNING and then a KASAN-reported slab-out-of-bounds write in __netif_set_xps_queue(). That is kernel heap corruption triggered by a normal operational action - loading an XDP program on a dense node, which is exactly the shape of GPU and storage hosts. The practical outcome is a node that can panic or misbehave at the moment an operator or a CNI loads XDP, forcing an unplanned drain.

Who can reach it

Local and privileged: loading an XDP program requires CAP_NET_ADMIN/CAP_BPF (root, or whatever daemon manages the dataplane). No remote or unauthenticated path. Only hosts with an affected Intel adapter driven by ixgbe, 64 or more CPUs, and XDP in use are exposed.

What to do

Install a stable kernel carrying the fix that skips XPS configuration for XDP Tx queues (backported across several stable branches; check the linked commits for your branch) and reboot the node after draining it. Until then, not loading XDP programs on affected ixgbe interfaces avoids the trigger entirely, which is a realistic mitigation if XDP is not part of your dataplane.

References

Related entries

• Linux kernel BPF: sleepable LSM cgroup programs sleep in an RCU read-side critical sectionCVE-2026-74338 · Linux kernel BPF verifier (sleepable BPF_LSM_CGROUP programs)High
• Linux kernel BPF: stale rbtree node linkage after bpf_rb_root_free allows erase on a freed rootCVE-2026-74344 · Linux kernel BPF (bpf_rb_root_free, rbtree node owner linkage)High
• Linux kernel BPF: BPF_PROG_QUERY writes the revision field past a short bpf_attr from userspaceCVE-2026-74371 · Linux kernel BPF BPF_PROG_QUERY (cgroup query revision write-back)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A race condition or locking defect in the amdkfd (KFDCVE-2026-74446 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): An out-of-bounds access in the amdkfd (KFD computeCVE-2026-74447 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
• Linux kernel THP split: use-after-free on the inode when memory-failure splits a shmem huge pageCVE-2026-74482 · Linux kernel mm/huge_memory (__folio_split i_mmap_rwsem release order)High