HIGH
xsk TxMetadata TOCTOU
CVE-2026-74707
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.3MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: xsk: validate metadata when processing requests The zero-copy path validates TX metadata while obtaining the descriptor context, then reads it again later when preparing the hardware request. User space can change the metadata between those operations and bypass the original validation. Validate the metadata in xsk_tx_metadata_request() and use the resulting flags snapshot for every feature check. Read request fields once so all zero-copy drivers process only values observed after successful validation.
02KernelScan AI Analysis
Risk summary
A local user with access to an AF_XDP socket on a zero-copy-capable NIC can race to mutate TX metadata after the kernel validates it but before the driver consumes it, bypassing validation and feeding arbitrary values into hardware offload programming. This can corrupt driver or hardware state and potentially escalate privileges or destabilize the system. The issue requires a zero-copy-capable network device and AF_XDP socket access.
Vulnerability analysis
In the AF_XDP zero-copy transmit path, the kernel checks transmit metadata when it first fetches the descriptor, but reads the same metadata again later when building the hardware request. Because that metadata lives in memory shared with userspace, a local process can alter flags and values between the check and the later read, bypassing validation and feeding arbitrary values into hardware offload setup. The fix validates the metadata at the moment the driver prepares the request, captures the allowed flags, and reads every field a single time so the driver sees only the values that passed validation. Any local user who can open an AF_XDP socket on a compatible network device can reach this path; no extra privileges are needed beyond socket access.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.14 | 6.14.2 | 6.15 | 5fd121971912 |
| 6.18 | — | 6.18.45 | 0cc7aa6e0d19 |
| mainline | — | 7.2 | — |
| 7.1 | — | 7.1.9 | 849b1664dbda |