CVE-2026-74708 - Vulnerability Details

- xsk: validate launch-time metadata size

Description

In the Linux kernel, the following vulnerability has been resolved:

xsk: validate launch-time metadata size

Launch-time metadata extends beyond the first 16 bytes of struct
xsk_tx_metadata. Reject the request when the registered metadata area does
not contain the complete field.

Snapshot the validated flags for the generic transmit path and use that
snapshot for request and completion processing, avoiding inconsistent
decisions if user space changes the flags concurrently.

Note that only xsk_skb_metadata is properly using the flags,
__xsk_buff_get_metadata ignores them. Next commits address that.

Published: 2026-08-22

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel includes a commit that validates the size of launch‑time metadata registered via the XSK API. Prior to this patch, metadata could be smaller than the full struct, causing the kernel to process incomplete information. This may lead to inconsistent request handling and unpredictable outcomes in the generic transmit path, potentially affecting network reliability.

Affected Systems

All Linux kernel builds that lack the commit introducing metadata size validation are vulnerable. Systems running older kernels on any distribution, whether embedded or general‑purpose, are affected until the fix is applied.

Risk and Exploitability

The high CVSS score of 7.8 reflects the potential impact of this flaw. The EPSS score of <1% indicates a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. No specific attack vector or privilege requirement is detailed in the description, so the risk level remains tied to the inherent severity of the flaw.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`ca4419f15abd19ba8be1e109661b60f9f5b6c9f0`	affected	< af511afa1d2977f384044df78d6fbf9fba653f7a
`ca4419f15abd19ba8be1e109661b60f9f5b6c9f0`	affected	< bc63d47611c07b0d5d655fe1a590861931527920
`ca4419f15abd19ba8be1e109661b60f9f5b6c9f0`	affected	< 439ce2dddf3d22129b9113a7881637256a35e936
`d9d736c416c9a85f84e15435ba82a177262e745b`	affected	—
`6.14.2`	affected	< 6.15

Linux

affected

Version	Status	Constraints
`6.15`	affected	—
`0`	unaffected	< 6.15
`6.18.45`	unaffected	≤ 6.18.*
`7.1.9`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[ca4419f15abd19ba8be1e109661b60f9f5b6c9f0,af511afa1d2977f384044df78d6fbf9fba653f7a)`	affected	code_commit	—
`[ca4419f15abd19ba8be1e109661b60f9f5b6c9f0,bc63d47611c07b0d5d655fe1a590861931527920)`	affected	code_commit	—
`[ca4419f15abd19ba8be1e109661b60f9f5b6c9f0,439ce2dddf3d22129b9113a7881637256a35e936)`	affected	code_commit	—
`d9d736c416c9a85f84e15435ba82a177262e745b`	affected	code_commit	—
`[6.14.2,6.15)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.15`	affected	semver	—
`[0,6.15)`	unaffected	semver	—
`[6.18.45,6.19.0)`	unaffected	semver	—
`[7.1.9,7.2.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply an updated Linux kernel that contains the commit enforcing metadata size validation.
Reboot the system to load the updated kernel.
As a temporary workaround, avoid using the XSK interface until a kernel update is available, or ensure that the metadata area supplied to xsk meets the required struct size.

Generated by OpenCVE AI on August 25, 2026 at 14:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00127.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/439ce2dddf3d22129b9113a7881637256a35e936
https://git.kernel.org/stable/c/af511afa1d2977f384044df78d6fbf9fba653f7a
https://git.kernel.org/stable/c/bc63d47611c07b0d5d655fe1a590861931527920
https://lore.kernel.org/linux-cve-announce/2026082237-CVE-2026-74708-e2a3@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74708
https://www.cve.org/CVERecord?id=CVE-2026-74708

History

Tue, 25 Aug 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-1284
References		https://lore.kernel.org/linux-cve-announce/2026082237-CVE-2026-74708-e2a3@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74708 https://www.cve.org/CVERecord?id=CVE-2026-74708
Metrics	threat_severity `None`	threat_severity `Low`

Tue, 25 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 22 Aug 2026 15:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: xsk: validate launch-time metadata size Launch-time metadata extends beyond the first 16 bytes of struct xsk_tx_metadata. Reject the request when the registered metadata area does not contain the complete field. Snapshot the validated flags for the generic transmit path and use that snapshot for request and completion processing, avoiding inconsistent decisions if user space changes the flags concurrently. Note that only xsk_skb_metadata is properly using the flags, __xsk_buff_get_metadata ignores them. Next commits address that.
Title		xsk: validate launch-time metadata size
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/439ce2dddf3d22129b9113a7881637256a35e936 https://git.kernel.org/stable/c/af511afa1d2977f384044df78d6fbf9fba653f7a https://git.kernel.org/stable/c/bc63d47611c07b0d5d655fe1a590861931527920

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-22T15:33:05.956Z

Updated: 2026-08-25T05:41:51.238Z

Reserved: 2026-08-15T05:44:03.927Z

Link: CVE-2026-74708

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-22T16:16:45.540

Modified: 2026-08-25T06:18:55.453

Link: CVE-2026-74708

Redhat

Severity : Low

Publid Date: 2026-08-22T00:00:00Z

Links: CVE-2026-74708 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-25T14:30:19Z

Weaknesses

CWE-1284
Improper Validation of Specified Quantity in Input

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object