Linux Kernel NULL Pointer Dereference Vulnerability in XSK Socket Teardown

A race condition leading to a NULL pointer dereference has been identified in the Linux kernel's XSK (eXpress Data Path) socket teardown process. This vulnerability arises because the unbinding procedure incorrectly sets the socket's device reference to NULL before ensuring that all network processing has completed. As a result, a process may attempt to access a NULL device pointer, causing a crash. The issue is exacerbated by the fact that the synchronization mechanism used does not account for all data plane operations, potentially allowing the socket's state to be cleaned up prematurely while it is still in use.

Impact

Exploitation of this vulnerability causes a kernel panic due to a NULL pointer dereference, which can lead to a denial of service by crashing the system.