CVE-2026-53250 is a vulnerability in Linux Kernel
Published on June 25, 2026
xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata()
In the Linux kernel, the following vulnerability has been resolved:
xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata()
The TX metadata area resides in the UMEM buffer which is memory-mapped
and concurrently writable by userspace. In xsk_skb_metadata(),
csum_start and csum_offset are read from shared memory for bounds
validation, then read again for skb assignment. A malicious userspace
application can race to overwrite these values between the two reads,
bypassing the bounds check and causing out-of-bounds memory access
during checksum computation in the transmit path.
Fix this by reading csum_start and csum_offset into local variables
once, then using the local copies for both validation and assignment.
Note that other metadata fields (flags, launch_time) and the cached
csum fields may be mutually inconsistent due to concurrent userspace
writes, but this is benign: the only security-critical invariant is
that each field's validated value is the same one used, which local
caching guarantees.
Products Associated with CVE-2026-53250
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 48eb03dd26304c24f03bdbb9382e89c8564e71df and below 0dfe05b938435892875e07771170051346412df9 is affected.
- Version 48eb03dd26304c24f03bdbb9382e89c8564e71df and below bfdfd2706d5fb2cd496a1506e680daf979309c8b is affected.
- Version 48eb03dd26304c24f03bdbb9382e89c8564e71df and below 22ba97ea9cc1f63a0d0244fae38057ed452b6ac7 is affected.
- Version 6.8 is affected.
- Before 6.8 is unaffected.
- Version 6.18.36, <= 6.18.* is unaffected.
- Version 7.0.13, <= 7.0.* is unaffected.
- Version 7.1, <= * is unaffected.