HIGH
xsk TxMetadata OOB
CVE-2026-74708
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI0.0LOW
01Description
In the Linux kernel, the following vulnerability has been resolved: xsk: validate launch-time metadata size Launch-time metadata extends beyond the first 16 bytes of struct xsk_tx_metadata. Reject the request when the registered metadata area does not contain the complete field. Snapshot the validated flags for the generic transmit path and use that snapshot for request and completion processing, avoiding inconsistent decisions if user space changes the flags concurrently. Note that only xsk_skb_metadata is properly using the flags, __xsk_buff_get_metadata ignores them. Next commits address that.
02KernelScan AI Analysis
Risk summary
A local user with access to AF_XDP sockets can trigger an out-of-bounds read from their transmit buffer by requesting launch-time metadata when the registered metadata area is too small, and can race concurrent flag changes to cause inconsistent kernel decisions about which offload features to apply. This results in incorrect metadata processing for transmitted packets.
Vulnerability analysis
The XSK transmit metadata path fails to validate that the registered metadata area is large enough to contain the launch-time field before reading it, allowing a local process to read from the wrong location within its own packet buffer. Additionally, the flags field is read multiple times without snapshotting, so a concurrent userspace writer can change it between validation and use, leading to inconsistent decisions about which metadata fields to process. The fix rejects requests when the metadata area is too small and snapshots the flags once for the entire transmit path. The vulnerable surface is reachable from a local process using AF_XDP sockets, which requires no special privileges beyond a normal user account.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.14 | 6.14.2 | 6.15 | af511afa1d29 |
| 6.18 | — | 6.18.45 | bc63d47611c0 |
| 7.1 | — | 7.1.9 | 439ce2dddf3d |
| mainline | — | 7.2 | — |