CVE-2026-74707

Summary

In the Linux kernel, the following vulnerability has been resolved:

xsk: validate metadata when processing requests

The zero-copy path validates TX metadata while obtaining the descriptor context, then reads it again later when preparing the hardware request. User space can change the metadata between those operations and bypass the original validation.

Validate the metadata in xsk_tx_metadata_request() and use the resulting flags snapshot for every feature check. Read request fields once so all zero-copy drivers process only values observed after successful validation.

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxca4419f15abd19ba8be1e109661b60f9f5b6c9f0 < 5fd121971912dee2f5af1efec64462ac722deb17affected
LinuxLinuxca4419f15abd19ba8be1e109661b60f9f5b6c9f0 < 0cc7aa6e0d19027fdd42e6fbd156267ac1e3bbbaaffected
LinuxLinuxca4419f15abd19ba8be1e109661b60f9f5b6c9f0 < 849b1664dbda1cf6c63e0fd4f9dec23782b8c851affected
LinuxLinuxd9d736c416c9a85f84e15435ba82a177262e745baffected
LinuxLinux6.14.2 < 6.15affected
LinuxLinux6.15affected
LinuxLinux0 < 6.15unaffected
LinuxLinux6.18.45 <= 6.18.*unaffected
LinuxLinux7.1.9 <= 7.1.*unaffected
LinuxLinux7.2 <= *unaffected

Weaknesses

References