This vulnerability occurs in the Linux kernel’s zero‑copy XDP/transmit (xsk) path. The kernel initially validates the TX metadata from user space while reading a descriptor context, then later reads the same metadata again when preparing the hardware request. Because the data can be altered by user space between those two operations, the kernel may process requests that bypass the original validation. The result is an inability to enforce the intended security checks, potentially allowing a malicious user to craft network packets that the kernel will transmit unfiltered. The flaw is essentially an input validation failure combined with a subtle race condition during the validation phase.

All Linux kernel builds that are missing the commit that patches the zero‑copy metadata validation. No specific affected versions are listed, so any system running a kernel older than the updated release that contains the fix is potentially vulnerable. The vendors affected are the Linux kernel maintainers; all distributions that ship the old kernel should refer to the patch from the Linux kernel repository.

While explicit CVSS or EPSS scores are unavailable, the nature of the flaw—local privilege escalation via a race in metadata validation—implies moderate to high risk if user space code can influence the XDP socket. The vulnerability is not currently in the CISA KEV catalog, suggesting no widespread exploitation has been documented yet. Nonetheless, because the flaw can be triggered by any user with access to the affected XDP interface, it should be treated as a serious local vulnerability that attackers can leverage to compromise kernel integrity.