The Linux kernel’s XSK subsystem contains a flaw that allows user‑space to modify packet metadata flags after the kernel has finished staging a packet. Because the kernel later re‑evaluates those same flags during the completion phase, it can mistakenly write a timestamp into the metadata even when the caller did not request one. This unintended timestamp alters the packet’s metadata buffer, creating kernel data corruption that can result in unstable kernel operation or other disruptive behavior.

All unpatched Linux kernel releases that include the XSK subsystem are affected. The issue is most pronounced in the mlx5 multi‑packet WQE path, where only the descriptor that starts a session clears its metadata pointer, allowing subsequent descriptors to be timestamped regardless of their own XDP_TXMD_FLAGS_TIMESTAMP setting. Therefore any Linux system running a kernel version without the patch to clear the metadata pointer during request processing is vulnerable.

The CVSS score of 5.5 indicates a medium severity, while the EPSS score of < 1% suggests a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local or privileged access, as the adversary must manipulate XDP‑enabled packets and modify metadata flags after submission. No public exploits are known, but the potential for kernel data corruption or disruptive behavior raises the risk to medium if an attacker can exercise that local access.