CVE-2024-27026 - Linux Kernel vmxnet3 Driver Vulnerability – Missing Reserved Tailroom Explained
In early 2024, a serious vulnerability was uncovered and subsequently patched in the Linux kernel's vmxnet3 network driver. This bug, tracked as CVE-2024-27026, could lead to instability or hard-to-trace errors in hosts or virtual machines utilizing VMware virtual NICs. In this article, we’ll unpack the root cause, the warning indicators, provide snippets of the problematic code, and provide pointers for sysadmins and developers to test or mitigate the issue.
What Is the vmxnet3 Driver?
vmxnet3 is VMware’s high-performance paravirtualized NIC driver in the Linux kernel. It is used in most enterprise VMware virtual environments when Linux runs as a guest OS.
The Bug in Simple Terms
Linux supports the eXpress Data Path (XDP), a fast path for packet processing. Every packet received should reserve a small space ("tailroom") at the end of its buffer, so that XDP can safely add any required metadata.
Because of a subtle bug, the vmxnet3 driver sometimes reserved the wrong amount of tailroom for non-dataring packets, which confused XDP, triggered kernel warnings, and potentially enabled a remote denial of service (DoS). This only happened for non-standard packet paths, so it wouldn’t always crash, but when it did, it was very noisy.
Here’s what sysadmins might see in system logs when the bug triggers
XDP_WARN: xdp_update_frame_from_buff(line:278): Driver BUG: missing reserved tailroom
WARNING: CPU: PID: at net/core/xdp.c:586 xdp_warn+xf/x20
CPU: PID: Comm: swapper/ Tainted: G W O 6.5.1 #1
RIP: 001:xdp_warn+xf/x20
...
? xdp_warn+xf/x20
xdp_do_redirect+x15f/x1c
vmxnet3_run_xdp+x17a/x400 [vmxnet3]
vmxnet3_process_xdp+xe4/x760 [vmxnet3]
? vmxnet3_tq_tx_complete.isra.+x21e/x2c [vmxnet3]
vmxnet3_rq_rx_complete+x7ad/x112 [vmxnet3]
vmxnet3_poll_rx_only+x2d/xa [vmxnet3]
__napi_poll+x20/x180
net_rx_action+x177/x390
Root Cause Analysis & Code Example
Inside the vmxnet3 driver, when handling received packets, the wrong variable was used to calculate how much space must be left at the tail of a packet. The bug was with the following lines:
Bad Code – Before the Fix
/* Incorrect: using rcd->len for the tailroom calculation */
xdp_frame->len = rcd->len;
skb->tail += rcd->len;
/* ...later, XDP expects space reserved based on rbi->len */
Good Code – After the Fix
/* Correct: using rbi->len (the right packet length) */
xdp_frame->len = rbi->len;
skb->tail += rbi->len;
/* Now, XDP sees the expected tailroom */
What changed:
- rcd->len was incorrectly used, but in some RX paths it does not account for all the correct buffer offsets/sizes.
The correct value is rbi->len, which always matches what the buffer actually contains.
This subtle bug could lead to memory corruption or improper behavior, especially when using advanced packet filters or XDP programs.
Here’s the patch that fixed the bug on November 2023
- Linux Kernel Patch Commit
- Patch discussion on lore.kernel.org
Particularly, kernels before v6.7
- Especially vulnerable if you are running custom XDP/eBPF programs
Proof of Concept Exploit
A full remote exploit is unlikely without local code execution, but a local user (or attacker with the ability to load XDP programs) can trigger the kernel warning / DoS by sending specially crafted packets at high rate.
Install an XDP drop program on a VMware Linux guest using vmxnet3
# Compile a simple XDP drop program:
clang -O2 -target bpf -c xdp_drop.c -o xdp_drop.o
# Attach to your vmxnet3 interface (e.g., eth)
ip link set dev eth xdp obj xdp_drop.o
2. Use a packet generator (like pktgen or scapy) on another machine to send various malformed or large packets to the guest.
Watch dmesg for the warning
dmesg | grep xdp_warn
Fix and Mitigation
Best Solution: Upgrade your kernel to 6.7 or later, or at least a stable version containing backported fix for CVE-2024-27026.
Workaround: If you cannot upgrade, avoid configuring XDP/eBPF programs on your affected VMware VMs running vulnerable kernels.
References
- CVE-2024-27026 at NVD
- Linux kernel commit fixing this issue
- Discussion (lore.kernel.org)
Final Words
This was a subtle but impactful bug affecting VMware virtual NIC users. While the direct attack vector may be limited, the exposure to kernel panic or misbehavior makes a kernel update urgent for any cloud, hosting, or enterprise infrastructure leveraging Linux on VMware. Always keep kernel drivers up to date!
*If you want to learn more about kernel security or how XDP works, check out the official XDP documentation.*
Timeline
Published on: 05/01/2024 13:15:48 UTC
Last modified on: 03/05/2025 15:11:27 UTC