CVE-2026-74708

xsk: validate launch-time metadata size

Published Aug 22, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

xsk: validate launch-time metadata size

Launch-time metadata extends beyond the first 16 bytes of struct
xsk_tx_metadata. Reject the request when the registered metadata area does
not contain the complete field.

Snapshot the validated flags for the generic transmit path and use that
snapshot for request and completion processing, avoiding inconsistent
decisions if user space changes the flags concurrently.

Note that only xsk_skb_metadata is properly using the flags,
__xsk_buff_get_metadata ignores them. Next commits address that.

Analysis

Technical impact

The Linux kernel includes a commit that validates the size of launch‑time metadata registered via the XSK API. Prior to this patch, metadata could be smaller than the full struct, causing the kernel to process incomplete information. This may lead to inconsistent request handling and unpredictable outcomes in the generic transmit path, potentially affecting network reliability.

Affected Systems

All Linux kernel builds that lack the commit introducing metadata size validation are vulnerable. Systems running older kernels on any distribution, whether embedded or general‑purpose, are affected until the fix is applied.

Risk and Exploitability

The high CVSS score of 7.8 reflects the potential impact of this flaw. The EPSS score of <1% indicates a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. No specific attack vector or privilege requirement is detailed in the description, so the risk level remains tied to the inherent severity of the flaw.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`ca4419f15abd19ba8be1e109661b60f9f5b6c9f0`	affected	< af511afa1d2977f384044df78d6fbf9fba653f7a
`ca4419f15abd19ba8be1e109661b60f9f5b6c9f0`	affected	< bc63d47611c07b0d5d655fe1a590861931527920
`ca4419f15abd19ba8be1e109661b60f9f5b6c9f0`	affected	< 439ce2dddf3d22129b9113a7881637256a35e936
`d9d736c416c9a85f84e15435ba82a177262e745b`	affected	—
`6.14.2`	affected	< 6.15

Linux

affected

Version	Status	Constraints
`6.15`	affected	—
`0`	unaffected	< 6.15
`6.18.45`	unaffected	≤ 6.18.*
`7.1.9`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[ca4419f15abd19ba8be1e109661b60f9f5b6c9f0,af511afa1d2977f384044df78d6fbf9fba653f7a)`	affected	code_commit	—
`[ca4419f15abd19ba8be1e109661b60f9f5b6c9f0,bc63d47611c07b0d5d655fe1a590861931527920)`	affected	code_commit	—
`[ca4419f15abd19ba8be1e109661b60f9f5b6c9f0,439ce2dddf3d22129b9113a7881637256a35e936)`	affected	code_commit	—
`d9d736c416c9a85f84e15435ba82a177262e745b`	affected	code_commit	—
`[6.14.2,6.15)`	affected	semver	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.15`	affected	semver	—
`[0,6.15)`	unaffected	semver	—
`[6.18.45,6.19.0)`	unaffected	semver	—
`[7.1.9,7.2.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply an updated Linux kernel that contains the commit enforcing metadata size validation.
Reboot the system to load the updated kernel.
As a temporary workaround, avoid using the XSK interface until a kernel update is available, or ensure that the metadata area supplied to xsk meets the required struct size.

Generated by OpenCVE AI on August 25, 2026 at 14:17 UTC.

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.127% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://git.kernel.org/stable/c/439ce2dddf3d22129b9113a7881637256a35e936
https://git.kernel.org/stable/c/af511afa1d2977f384044df78d6fbf9fba653f7a
https://git.kernel.org/stable/c/bc63d47611c07b0d5d655fe1a590861931527920
https://lore.kernel.org/linux-cve-announce/2026082237-CVE-2026-74708-e2a3@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74708
https://www.cve.org/CVERecord?id=CVE-2026-74708

History

Oct 16, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 25, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-1284
References		https://lore.kernel.org/linux-cve-announce/2026082237-CVE-2026-74708-e2a3@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74708 https://www.cve.org/CVERecord?id=CVE-2026-74708
Metrics	threat_severity `None`	threat_severity `Low`

Aug 25, 2026 6:00 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Aug 22, 2026 3:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: xsk: validate launch-time metadata size Launch-time metadata extends beyond the first 16 bytes of struct xsk_tx_metadata. Reject the request when the registered metadata area does not contain the complete field. Snapshot the validated flags for the generic transmit path and use that snapshot for request and completion processing, avoiding inconsistent decisions if user space changes the flags concurrently. Note that only xsk_skb_metadata is properly using the flags, __xsk_buff_get_metadata ignores them. Next commits address that.
Title		xsk: validate launch-time metadata size
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/439ce2dddf3d22129b9113a7881637256a35e936 https://git.kernel.org/stable/c/af511afa1d2977f384044df78d6fbf9fba653f7a https://git.kernel.org/stable/c/bc63d47611c07b0d5d655fe1a590861931527920