HIGH Introduced in 6.8
xsk TxMetadata OOB
CVE-2026-74710
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.1MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: xsk: require at least 16 bytes of TX metadata AF_XDP accepts a TX metadata length as small as eight bytes, but every supported request needs the flags plus at least one eight-byte request field. Such short metadata also lets the kernel read beyond the registered area. Require 16 bytes rather than sizeof(struct xsk_tx_metadata) to preserve compatibility with applications that do not use launch-time metadata.
02KernelScan AI Analysis
Risk summary
A local process with networking privileges obtainable via user namespaces can register an AF_XDP memory region with only eight bytes of metadata, causing the kernel to read beyond the registered buffer. This out-of-bounds read may leak adjacent memory and can be reliably driven to trigger a kernel oops. Products that allow untrusted local code or container workloads with user namespace support are most exposed.
Vulnerability analysis
The AF_XDP socket subsystem allows an application to register a transmit metadata area as small as eight bytes, but the kernel reads at least sixteen bytes when processing a transmission request — a flags field plus a request field. That causes the kernel to read beyond the registered metadata area, potentially accessing memory outside the intended buffer. The fix enforces a minimum metadata length of sixteen bytes so the kernel stays within the registered boundary. Any local process that can create an AF_XDP socket can trigger this; on default configurations the required privilege is available to unprivileged users through user namespaces.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 6.8 | 6.12.104 | 21b8536aee81 |
| 6.18 | 6.8 | 6.18.45 | 642c6e73fce1 |
| mainline | 6.8 | 7.2 | 1bb30b181d9f |
| 7.1 | 6.8 | 7.1.9 | cfb9d2976b27 |
| cip/6.12 | 6.8 | 6.12.104-cip30 | 21b8536aee81 |