Riskcovery

CVE-2026-74710

xsk: require at least 16 bytes of TX metadata

State
Published
Severity
7.8 High
Published
Aug 22, 2026
Updated
Oct 16, 2026
Reserved
Aug 15, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

xsk: require at least 16 bytes of TX metadata

AF_XDP accepts a TX metadata length as small as eight bytes, but every supported request needs the flags plus at least one eight-byte request field. Such short metadata also lets the kernel read beyond the registered area.

Require 16 bytes rather than sizeof(struct xsk_tx_metadata) to preserve compatibility with applications that do not use launch-time metadata.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 341ac980eab90ac1f6c22ee9f9da83ed9604d899 to before 21b8536aee819792f1b4b38b9aacf2a073025d49Affected
  • 341ac980eab90ac1f6c22ee9f9da83ed9604d899 to before 642c6e73fce17fdca93a5793c4d22359fda866d7Affected
  • 341ac980eab90ac1f6c22ee9f9da83ed9604d899 to before cfb9d2976b277e554e28c165e3eff4b4a8ea10bdAffected
  • 341ac980eab90ac1f6c22ee9f9da83ed9604d899 to before 1bb30b181d9f0484e141f8411e15ed906d5c6780Affected
LinuxLinux
  • 6.8Affected
  • before 6.8Not affected
  • 6.12.104 through 6.12.*Not affected
  • 6.18.45 through 6.18.*Not affected
  • 7.1.9 through 7.1.*Not affected
  • 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.