CVE-2026-74707

In the Linux kernel, the following vulnerability has been resolved: xsk: validate metadata when processing requests The zero-copy path validates TX metadata while obtaining the descriptor context, then reads it again later when preparing the hardware request. User space can change the metadata between those operations and bypass the original validation. Validate the metadata in xsk_tx_metadata_request() and use the resulting flags snapshot for every feature check. Read request fields once so all zero-copy drivers process only values observed after successful validation.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/0cc7aa6e0d19027fdd42e6fbd156267ac1e3bbba
https://git.kernel.org/stable/c/5fd121971912dee2f5af1efec64462ac722deb17
https://git.kernel.org/stable/c/849b1664dbda1cf6c63e0fd4f9dec23782b8c851

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-22 16:16

Updated : 2026-08-25 06:18

NVD link : CVE-2026-74707

Mitre link : CVE-2026-74707

CVE.ORG link : CVE-2026-74707

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-74707", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "ca4419f15abd19ba8be1e109661b60f9f5b6c9f0", "lessThan": "5fd121971912dee2f5af1efec64462ac722deb17", "versionType": "git"}, {"status": "affected", "version": "ca4419f15abd19ba8be1e109661b60f9f5b6c9f0", "lessThan": "0cc7aa6e0d19027fdd42e6fbd156267ac1e3bbba", "versionType": "git"}, {"status": "affected", "version": "ca4419f15abd19ba8be1e109661b60f9f5b6c9f0", "lessThan": "849b1664dbda1cf6c63e0fd4f9dec23782b8c851", "versionType": "git"}, {"status": "affected", "version": "d9d736c416c9a85f84e15435ba82a177262e745b", "versionType": "git"}, {"status": "affected", "version": "6.14.2", "lessThan": "6.15", "versionType": "semver"}], "programFiles": ["drivers/net/ethernet/intel/igc/igc_main.c", "drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c", "drivers/net/ethernet/stmicro/stmmac/stmmac_main.c", "include/net/libeth/xsk.h", "include/net/xdp_sock_drv.h", "net/xdp/xsk_buff_pool.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.15"}, {"status": "unaffected", "version": "0", "lessThan": "6.15", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.45", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.9", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/intel/igc/igc_main.c", "drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c", "drivers/net/ethernet/stmicro/stmmac/stmmac_main.c", "include/net/libeth/xsk.h", "include/net/xdp_sock_drv.h", "net/xdp/xsk_buff_pool.c"], "defaultStatus": "affected"}]}], "published": "2026-08-22T16:16:45.433", "references": [{"url": "https://git.kernel.org/stable/c/0cc7aa6e0d19027fdd42e6fbd156267ac1e3bbba", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/5fd121971912dee2f5af1efec64462ac722deb17", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/849b1664dbda1cf6c63e0fd4f9dec23782b8c851", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: validate metadata when processing requests\n\nThe zero-copy path validates TX metadata while obtaining the descriptor\ncontext, then reads it again later when preparing the hardware request.\nUser space can change the metadata between those operations and bypass the\noriginal validation.\n\nValidate the metadata in xsk_tx_metadata_request() and use the resulting\nflags snapshot for every feature check. Read request fields once so all\nzero-copy drivers process only values observed after successful\nvalidation."}], "lastModified": "2026-08-25T06:18:55.180", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}