Linux Kernel xsk LaunchTime Metadata Size Validation Vulnerability
CVE-2026-74708 Published on August 22, 2026
xsk: validate launch-time metadata size
In the Linux kernel, the following vulnerability has been resolved:
xsk: validate launch-time metadata size
Launch-time metadata extends beyond the first 16 bytes of struct
xsk_tx_metadata. Reject the request when the registered metadata area does
not contain the complete field.
Snapshot the validated flags for the generic transmit path and use that
snapshot for request and completion processing, avoiding inconsistent
decisions if user space changes the flags concurrently.
Note that only xsk_skb_metadata is properly using the flags,
__xsk_buff_get_metadata ignores them. Next commits address that.
Products Associated with CVE-2026-74708
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version ca4419f15abd19ba8be1e109661b60f9f5b6c9f0 and below af511afa1d2977f384044df78d6fbf9fba653f7a is affected.
- Version ca4419f15abd19ba8be1e109661b60f9f5b6c9f0 and below bc63d47611c07b0d5d655fe1a590861931527920 is affected.
- Version ca4419f15abd19ba8be1e109661b60f9f5b6c9f0 and below 439ce2dddf3d22129b9113a7881637256a35e936 is affected.
- Version d9d736c416c9a85f84e15435ba82a177262e745b is affected.
- Version 6.14.2 and below 6.15 is affected.
- Version 6.15 is affected.
- Before 6.15 is unaffected.
- Version 6.18.45, <= 6.18.* is unaffected.
- Version 7.1.9, <= 7.1.* is unaffected.
- Version 7.2, <= * is unaffected.