CVE-2026-74709 (GCVE-0-2026-74709)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:33 – Updated: 2026-08-22 15:33
VLAI
Title
xsk: clear metadata pointer when no timestamp is requested
Summary
In the Linux kernel, the following vulnerability has been resolved: xsk: clear metadata pointer when no timestamp is requested User space can change metadata flags after request processing. Rereading them during completion can therefore make the kernel write a timestamp that was not requested when the packet was submitted. Clear the metadata pointer during request processing unless timestamp completion is requested. Completion handling can then use the pointer itself instead of rereading the flags. On the mlx5 multi-packet WQE path metadata is evaluated per batch: xsk_tx_metadata_request() runs only for the descriptor that starts a session, just like the checksum offload that is applied once through the shared WQE. Only that descriptor's pointer is reset, so completion handling can record a timestamp for the other descriptors of the session regardless of their own XDP_TXMD_FLAGS_TIMESTAMP bit. The write stays inside the metadata area; the single-WQE, other zero-copy, and generic paths reset the pointer per descriptor and are unaffected.
Severity
No CVSS data available.
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 6666 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ca4419f15abd19ba8be1e109661b60f9f5b6c9f0 , < 0ba2e1eb07a826d021344e2f146b6716c58139eb (git)
Affected: ca4419f15abd19ba8be1e109661b60f9f5b6c9f0 , < eb4c613d4ebc3f664e70d572b8867ba114a8754e (git)
Affected: ca4419f15abd19ba8be1e109661b60f9f5b6c9f0 , < 9f60a67df8d3c862503bee62bada8e7089cba438 (git)
Affected: d9d736c416c9a85f84e15435ba82a177262e745b (git)
Affected: 6.14.2 , < 6.15 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.15
Unaffected: 0 , < 6.15 (semver)
Unaffected: 6.18.45 , ≤ 6.18.* (semver)
Unaffected: 7.1.9 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/xdp_sock.h",
            "net/xdp/xsk.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0ba2e1eb07a826d021344e2f146b6716c58139eb",
              "status": "affected",
              "version": "ca4419f15abd19ba8be1e109661b60f9f5b6c9f0",
              "versionType": "git"
            },
            {
              "lessThan": "eb4c613d4ebc3f664e70d572b8867ba114a8754e",
              "status": "affected",
              "version": "ca4419f15abd19ba8be1e109661b60f9f5b6c9f0",
              "versionType": "git"
            },
            {
              "lessThan": "9f60a67df8d3c862503bee62bada8e7089cba438",
              "status": "affected",
              "version": "ca4419f15abd19ba8be1e109661b60f9f5b6c9f0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d9d736c416c9a85f84e15435ba82a177262e745b",
              "versionType": "git"
            },
            {
              "lessThan": "6.15",
              "status": "affected",
              "version": "6.14.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/xdp_sock.h",
            "net/xdp/xsk.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.14.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: clear metadata pointer when no timestamp is requested\n\nUser space can change metadata flags after request processing. Rereading\nthem during completion can therefore make the kernel write a timestamp\nthat was not requested when the packet was submitted.\n\nClear the metadata pointer during request processing unless timestamp\ncompletion is requested. Completion handling can then use the pointer\nitself instead of rereading the flags.\n\nOn the mlx5 multi-packet WQE path metadata is evaluated per batch:\nxsk_tx_metadata_request() runs only for the descriptor that starts a\nsession, just like the checksum offload that is applied once through the\nshared WQE. Only that descriptor\u0027s pointer is reset, so completion\nhandling can record a timestamp for the other descriptors of the session\nregardless of their own XDP_TXMD_FLAGS_TIMESTAMP bit. The write stays\ninside the metadata area; the single-WQE, other zero-copy, and generic\npaths reset the pointer per descriptor and are unaffected."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-22T15:33:06.558Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0ba2e1eb07a826d021344e2f146b6716c58139eb"
        },
        {
          "url": "https://git.kernel.org/stable/c/eb4c613d4ebc3f664e70d572b8867ba114a8754e"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f60a67df8d3c862503bee62bada8e7089cba438"
        }
      ],
      "title": "xsk: clear metadata pointer when no timestamp is requested",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74709",
    "datePublished": "2026-08-22T15:33:06.558Z",
    "dateReserved": "2026-08-15T05:44:03.927Z",
    "dateUpdated": "2026-08-22T15:33:06.558Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74709",
      "date": "2026-10-16",
      "epss": "0.00206",
      "percentile": "0.09978"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "include/net/xdp_sock.h",
                  "net/xdp/xsk.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "0ba2e1eb07a826d021344e2f146b6716c58139eb",
                    "status": "affected",
                    "version": "ca4419f15abd19ba8be1e109661b60f9f5b6c9f0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "eb4c613d4ebc3f664e70d572b8867ba114a8754e",
                    "status": "affected",
                    "version": "ca4419f15abd19ba8be1e109661b60f9f5b6c9f0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9f60a67df8d3c862503bee62bada8e7089cba438",
                    "status": "affected",
                    "version": "ca4419f15abd19ba8be1e109661b60f9f5b6c9f0",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "d9d736c416c9a85f84e15435ba82a177262e745b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.15",
                    "status": "affected",
                    "version": "6.14.2",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "include/net/xdp_sock.h",
                  "net/xdp/xsk.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.15"
                  },
                  {
                    "lessThan": "6.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.45",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.9",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: clear metadata pointer when no timestamp is requested\n\nUser space can change metadata flags after request processing. Rereading\nthem during completion can therefore make the kernel write a timestamp\nthat was not requested when the packet was submitted.\n\nClear the metadata pointer during request processing unless timestamp\ncompletion is requested. Completion handling can then use the pointer\nitself instead of rereading the flags.\n\nOn the mlx5 multi-packet WQE path metadata is evaluated per batch:\nxsk_tx_metadata_request() runs only for the descriptor that starts a\nsession, just like the checksum offload that is applied once through the\nshared WQE. Only that descriptor\u0027s pointer is reset, so completion\nhandling can record a timestamp for the other descriptors of the session\nregardless of their own XDP_TXMD_FLAGS_TIMESTAMP bit. The write stays\ninside the metadata area; the single-WQE, other zero-copy, and generic\npaths reset the pointer per descriptor and are unaffected."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nxsk: borrar el puntero de metadatos cuando no se solicita una marca de tiempo\n\nEl espacio de usuario puede cambiar los indicadores de metadatos despu\u00e9s del procesamiento de la solicitud. Volver a leerlos durante la finalizaci\u00f3n puede, por lo tanto, hacer que el kernel escriba una marca de tiempo que no fue solicitada cuando el paquete fue enviado.\n\nBorrar el puntero de metadatos durante el procesamiento de la solicitud a menos que se solicite la finalizaci\u00f3n de la marca de tiempo. El manejo de la finalizaci\u00f3n puede entonces usar el propio puntero en lugar de volver a leer los indicadores.\n\nEn la ruta WQE de m\u00faltiples paquetes mlx5, los metadatos son evaluados por lote: xsk_tx_metadata_request() se ejecuta solo para el descriptor que inicia una sesi\u00f3n, al igual que la descarga de suma de verificaci\u00f3n que se aplica una vez a trav\u00e9s del WQE compartido. Solo el puntero de ese descriptor se restablece, por lo que el manejo de la finalizaci\u00f3n puede registrar una marca de tiempo para los otros descriptores de la sesi\u00f3n independientemente de su propio bit XDP_TXMD_FLAGS_TIMESTAMP. La escritura permanece dentro del \u00e1rea de metadatos; las rutas de WQE \u00fanico, otras de copia cero y gen\u00e9ricas restablecen el puntero por descriptor y no se ven afectadas."
          }
        ],
        "id": "CVE-2026-74709",
        "lastModified": "2026-10-14T13:10:00.187",
        "metrics": {},
        "published": "2026-08-22T16:16:45.640",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0ba2e1eb07a826d021344e2f146b6716c58139eb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9f60a67df8d3c862503bee62bada8e7089cba438"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/eb4c613d4ebc3f664e70d572b8867ba114a8754e"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-25T10:02:40+00:00",
      "cve": "CVE-2026-74709",
      "id": "CVE-2026-74709",
      "initial_release_date": "2026-08-22T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: xsk: clear metadata pointer when no timestamp is requested",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74709.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.