FKIE_CVE-2026-74709

Vulnerability from fkie_nvd - Published: 2026-08-22 16:16 - Updated: 2026-10-14 13:10
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: xsk: clear metadata pointer when no timestamp is requested User space can change metadata flags after request processing. Rereading them during completion can therefore make the kernel write a timestamp that was not requested when the packet was submitted. Clear the metadata pointer during request processing unless timestamp completion is requested. Completion handling can then use the pointer itself instead of rereading the flags. On the mlx5 multi-packet WQE path metadata is evaluated per batch: xsk_tx_metadata_request() runs only for the descriptor that starts a session, just like the checksum offload that is applied once through the shared WQE. Only that descriptor's pointer is reset, so completion handling can record a timestamp for the other descriptors of the session regardless of their own XDP_TXMD_FLAGS_TIMESTAMP bit. The write stays inside the metadata area; the single-WQE, other zero-copy, and generic paths reset the pointer per descriptor and are unaffected.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/0ba2e1eb07a826d021344e2f146b6716c58139eb
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/9f60a67df8d3c862503bee62bada8e7089cba438
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/eb4c613d4ebc3f664e70d572b8867ba114a8754e
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/xdp_sock.h",
            "net/xdp/xsk.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0ba2e1eb07a826d021344e2f146b6716c58139eb",
              "status": "affected",
              "version": "ca4419f15abd19ba8be1e109661b60f9f5b6c9f0",
              "versionType": "git"
            },
            {
              "lessThan": "eb4c613d4ebc3f664e70d572b8867ba114a8754e",
              "status": "affected",
              "version": "ca4419f15abd19ba8be1e109661b60f9f5b6c9f0",
              "versionType": "git"
            },
            {
              "lessThan": "9f60a67df8d3c862503bee62bada8e7089cba438",
              "status": "affected",
              "version": "ca4419f15abd19ba8be1e109661b60f9f5b6c9f0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d9d736c416c9a85f84e15435ba82a177262e745b",
              "versionType": "git"
            },
            {
              "lessThan": "6.15",
              "status": "affected",
              "version": "6.14.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/xdp_sock.h",
            "net/xdp/xsk.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: clear metadata pointer when no timestamp is requested\n\nUser space can change metadata flags after request processing. Rereading\nthem during completion can therefore make the kernel write a timestamp\nthat was not requested when the packet was submitted.\n\nClear the metadata pointer during request processing unless timestamp\ncompletion is requested. Completion handling can then use the pointer\nitself instead of rereading the flags.\n\nOn the mlx5 multi-packet WQE path metadata is evaluated per batch:\nxsk_tx_metadata_request() runs only for the descriptor that starts a\nsession, just like the checksum offload that is applied once through the\nshared WQE. Only that descriptor\u0027s pointer is reset, so completion\nhandling can record a timestamp for the other descriptors of the session\nregardless of their own XDP_TXMD_FLAGS_TIMESTAMP bit. The write stays\ninside the metadata area; the single-WQE, other zero-copy, and generic\npaths reset the pointer per descriptor and are unaffected."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nxsk: borrar el puntero de metadatos cuando no se solicita una marca de tiempo\n\nEl espacio de usuario puede cambiar los indicadores de metadatos despu\u00e9s del procesamiento de la solicitud. Volver a leerlos durante la finalizaci\u00f3n puede, por lo tanto, hacer que el kernel escriba una marca de tiempo que no fue solicitada cuando el paquete fue enviado.\n\nBorrar el puntero de metadatos durante el procesamiento de la solicitud a menos que se solicite la finalizaci\u00f3n de la marca de tiempo. El manejo de la finalizaci\u00f3n puede entonces usar el propio puntero en lugar de volver a leer los indicadores.\n\nEn la ruta WQE de m\u00faltiples paquetes mlx5, los metadatos son evaluados por lote: xsk_tx_metadata_request() se ejecuta solo para el descriptor que inicia una sesi\u00f3n, al igual que la descarga de suma de verificaci\u00f3n que se aplica una vez a trav\u00e9s del WQE compartido. Solo el puntero de ese descriptor se restablece, por lo que el manejo de la finalizaci\u00f3n puede registrar una marca de tiempo para los otros descriptores de la sesi\u00f3n independientemente de su propio bit XDP_TXMD_FLAGS_TIMESTAMP. La escritura permanece dentro del \u00e1rea de metadatos; las rutas de WQE \u00fanico, otras de copia cero y gen\u00e9ricas restablecen el puntero por descriptor y no se ven afectadas."
    }
  ],
  "id": "CVE-2026-74709",
  "lastModified": "2026-10-14T13:10:00.187",
  "metrics": {},
  "published": "2026-08-22T16:16:45.640",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/0ba2e1eb07a826d021344e2f146b6716c58139eb"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/9f60a67df8d3c862503bee62bada8e7089cba438"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/eb4c613d4ebc3f664e70d572b8867ba114a8754e"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.