CVE-2026-74710

AF_XDP in the Linux kernel accepts a transmit (TX) metadata length as small as eight bytes. Because each supported request requires the flags field plus at least one eight-byte data field, allowing a short buffer lets the kernel read beyond the area that was registered. This out-of-bounds read can expose data that should be protected or cause a kernel fault, potentially resulting in a denial-of-service or information disclosure. The weakness corresponds to a classical memory overread (CWE-125).

The vulnerability affects all Linux kernel releases that include the AF_XDP driver and do not enforce a 16-byte minimum for TX metadata. No specific kernel patch level is identified in the advisory, so every build prior to the commit that added the 16-byte requirement is considered vulnerable. The flaw is limited to systems that use AF_XDP sockets.

The EPSS score is reported as < 1% and the CVSS score of 7.8 indicates a high severity issue. The likely attack vector is local, requiring an application or attacker that can construct an AF_XDP request with undersized TX metadata. While exploitation has not been documented, the out-of-bounds read could lead to information disclosure or a kernel crash. The vulnerability is not listed in the CISA KEV catalog, and the low EPSS probability suggests that exploitation is currently unlikely, but the high CVSS score warrants timely mitigation.