Linux kernel xdp_sock overflow in xsk_build_skb() leads to descriptor loss
CVE-2026-74559 Published on August 15, 2026
xsk: drain continuation descs after overflow in xsk_build_skb()
In the Linux kernel, the following vulnerability has been resolved:
xsk: drain continuation descs after overflow in xsk_build_skb()
Fix generic xmit path multi-buffer logic when packets are either too big
(count of descriptors exceed MAX_SKB_FRAGS) or an invalid descriptor is
included in fragmented packet. Introduce xdp_sock::drain_cont and act
upon this flag - when it is set, keep on consuming descriptors from
AF_XDP Tx ring and put them directly onto Cq. Previously these
descriptors were silently lost and could never be reached again.
Products Associated with CVE-2026-74559
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version cf24f5a5feeaae34c1a34d1e04f8ac697290427a and below ceb00cb87a22c42d20c39336213db2b843ca9e34 is affected.
- Version cf24f5a5feeaae34c1a34d1e04f8ac697290427a and below 5e94d74e4f3baebaa083288f33b4be7ce0a34982 is affected.
- Version cf24f5a5feeaae34c1a34d1e04f8ac697290427a and below bd44a6dcd4248883de90f5dad53ae80066e27096 is affected.
- Version 6.6 is affected.
- Before 6.6 is unaffected.
- Version 6.18.44, <= 6.18.* is unaffected.
- Version 7.1.8, <= 7.1.* is unaffected.
- Version 7.2-rc6, <= * is unaffected.