Stable kernel fixes AF_XDP TOCTOU race in TX checksum path

Linux stable kernels are picking up a fix for a time-of-check-to-time-of-use race in AF_XDP transmit metadata handling that could let a local userspace program trigger out-of-bounds memory access during checksum offload.

AF_XDP sockets map UMEM buffers that userspace can write concurrently. On the transmit path, the kernel read the checksum start and offset fields from that shared metadata once to validate bounds, then read them again when attaching them to the socket buffer. A hostile process could change the values in between, defeating the check and causing an out-of-bounds access while the stack computed the checksum.

Jason Xing fixed the bug by reading those two fields into local variables a single time and using the cached copies for both validation and assignment. Other metadata fields can still drift under concurrent writes, but that inconsistency is treated as benign; the security-critical requirement is that each validated value is the one actually used.

The change is being queued for the 6.12 stable series. It closes a hole introduced when AF_XDP gained TX timestamp and checksum offload support.