Vulnerability-Lookup

FKIE_CVE-2026-74710

Vulnerability from fkie_nvd - Published: 2026-08-22 16:16 - Updated: 2026-10-14 13:10

Severity

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: xsk: require at least 16 bytes of TX metadata AF_XDP accepts a TX metadata length as small as eight bytes, but every supported request needs the flags plus at least one eight-byte request field. Such short metadata also lets the kernel read beyond the registered area. Require 16 bytes rather than sizeof(struct xsk_tx_metadata) to preserve compatibility with applications that do not use launch-time metadata.

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/1bb30b181d9f0484e141f8411e15ed906d5c6780
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/21b8536aee819792f1b4b38b9aacf2a073025d49
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/642c6e73fce17fdca93a5793c4d22359fda866d7
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/cfb9d2976b277e554e28c165e3eff4b4a8ea10bd

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/xdp/xdp_umem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "21b8536aee819792f1b4b38b9aacf2a073025d49",
              "status": "affected",
              "version": "341ac980eab90ac1f6c22ee9f9da83ed9604d899",
              "versionType": "git"
            },
            {
              "lessThan": "642c6e73fce17fdca93a5793c4d22359fda866d7",
              "status": "affected",
              "version": "341ac980eab90ac1f6c22ee9f9da83ed9604d899",
              "versionType": "git"
            },
            {
              "lessThan": "cfb9d2976b277e554e28c165e3eff4b4a8ea10bd",
              "status": "affected",
              "version": "341ac980eab90ac1f6c22ee9f9da83ed9604d899",
              "versionType": "git"
            },
            {
              "lessThan": "1bb30b181d9f0484e141f8411e15ed906d5c6780",
              "status": "affected",
              "version": "341ac980eab90ac1f6c22ee9f9da83ed9604d899",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/xdp/xdp_umem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: require at least 16 bytes of TX metadata\n\nAF_XDP accepts a TX metadata length as small as eight bytes, but every\nsupported request needs the flags plus at least one eight-byte request\nfield. Such short metadata also lets the kernel read beyond the registered\narea.\n\nRequire 16 bytes rather than sizeof(struct xsk_tx_metadata) to preserve\ncompatibility with applications that do not use launch-time metadata."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nxsk: requiere al menos 16 bytes de metadatos TX\n\nAF_XDP acepta una longitud de metadatos TX tan peque\u00f1a como ocho bytes, pero cada solicitud compatible necesita los flags m\u00e1s al menos un campo de solicitud de ocho bytes. Dichos metadatos cortos tambi\u00e9n permiten al kernel leer m\u00e1s all\u00e1 del \u00e1rea registrada.\n\nRequerir 16 bytes en lugar de sizeof(struct xsk_tx_metadata) para preservar la compatibilidad con aplicaciones que no utilizan metadatos en tiempo de lanzamiento."
    }
  ],
  "id": "CVE-2026-74710",
  "lastModified": "2026-10-14T13:10:00.187",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-08-22T16:16:45.743",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/1bb30b181d9f0484e141f8411e15ed906d5c6780"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/21b8536aee819792f1b4b38b9aacf2a073025d49"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/642c6e73fce17fdca93a5793c4d22359fda866d7"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/cfb9d2976b277e554e28c165e3eff4b4a8ea10bd"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

CVE-2026-74710 (GCVE-0-2026-74710)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:33 – Updated: 2026-08-25 05:41

Title

xsk: require at least 16 bytes of TX metadata

Summary

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6667 records in the last 180 days details

References

4 references

URL	Tags
https://git.kernel.org/stable/c/21b8536aee819792f…
https://git.kernel.org/stable/c/642c6e73fce17fdca…
https://git.kernel.org/stable/c/cfb9d2976b277e554…
https://git.kernel.org/stable/c/1bb30b181d9f0484e…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 341ac980eab90ac1f6c22ee9f9da83ed9604d899 , < 21b8536aee819792f1b4b38b9aacf2a073025d49 (git) Affected: 341ac980eab90ac1f6c22ee9f9da83ed9604d899 , < 642c6e73fce17fdca93a5793c4d22359fda866d7 (git) Affected: 341ac980eab90ac1f6c22ee9f9da83ed9604d899 , < cfb9d2976b277e554e28c165e3eff4b4a8ea10bd (git) Affected: 341ac980eab90ac1f6c22ee9f9da83ed9604d899 , < 1bb30b181d9f0484e141f8411e15ed906d5c6780 (git)
Linux	Linux	Affected: 6.8 Unaffected: 0 , < 6.8 (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/xdp/xdp_umem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "21b8536aee819792f1b4b38b9aacf2a073025d49",
              "status": "affected",
              "version": "341ac980eab90ac1f6c22ee9f9da83ed9604d899",
              "versionType": "git"
            },
            {
              "lessThan": "642c6e73fce17fdca93a5793c4d22359fda866d7",
              "status": "affected",
              "version": "341ac980eab90ac1f6c22ee9f9da83ed9604d899",
              "versionType": "git"
            },
            {
              "lessThan": "cfb9d2976b277e554e28c165e3eff4b4a8ea10bd",
              "status": "affected",
              "version": "341ac980eab90ac1f6c22ee9f9da83ed9604d899",
              "versionType": "git"
            },
            {
              "lessThan": "1bb30b181d9f0484e141f8411e15ed906d5c6780",
              "status": "affected",
              "version": "341ac980eab90ac1f6c22ee9f9da83ed9604d899",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/xdp/xdp_umem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: require at least 16 bytes of TX metadata\n\nAF_XDP accepts a TX metadata length as small as eight bytes, but every\nsupported request needs the flags plus at least one eight-byte request\nfield. Such short metadata also lets the kernel read beyond the registered\narea.\n\nRequire 16 bytes rather than sizeof(struct xsk_tx_metadata) to preserve\ncompatibility with applications that do not use launch-time metadata."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through local AF_XDP setup\u2014socket(AF_XDP), setsockopt(XDP_UMEM_REG) with tx_metadata_len=8, ring configuration, bind, and TX descriptor submission\u2014not via remote packet handling or network-facing services.\nAC:L - The attacker fully controls tx_metadata_len, descriptor addresses, metadata flags, and TX timing, and can place frames at chunk boundaries to reliably trigger kernel reads/writes past the declared 8-byte metadata headroom.\nPR:L - AF_XDP socket creation requires CAP_NET_RAW (xsk_create()); per kernel CNA guidance this is Low because unprivileged processes can obtain it inside user/network namespaces (e.g., unshare -Urn).\nUI:N - No victim action is required; the attacker configures their own AF_XDP socket, UMEM, rings, and TX descriptors to trigger the faulty metadata handling during transmit.\nS:U - Impact is confined to kernel processing of attacker-supplied AF_XDP metadata and pinned UMEM frames; it does not cross VM, hypervisor, or IOMMU isolation boundaries.\nC:H - With only 8 bytes registered, the kernel still dereferences xsk_tx_metadata request fields (checksum, launch time) beyond the metadata area; this out-of-bounds read can cross chunk/UMEM boundaries and expose adjacent memory.\nI:H - TX timestamp completion writes through meta-\u003ecompletion.tx_timestamp when only 8 bytes of metadata were reserved, causing an out-of-bounds write past the registered metadata headroom that can corrupt adjacent memory or be leveraged further.\nA:H - Reading or writing metadata fields beyond the registered length at chunk/UMEM edges can access unmapped pages and trigger kernel faults; out-of-bounds kernel accesses in this path can cause oops/panic-level denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:41:52.464Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/21b8536aee819792f1b4b38b9aacf2a073025d49"
        },
        {
          "url": "https://git.kernel.org/stable/c/642c6e73fce17fdca93a5793c4d22359fda866d7"
        },
        {
          "url": "https://git.kernel.org/stable/c/cfb9d2976b277e554e28c165e3eff4b4a8ea10bd"
        },
        {
          "url": "https://git.kernel.org/stable/c/1bb30b181d9f0484e141f8411e15ed906d5c6780"
        }
      ],
      "title": "xsk: require at least 16 bytes of TX metadata",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74710",
    "datePublished": "2026-08-22T15:33:07.172Z",
    "dateReserved": "2026-08-15T05:44:03.928Z",
    "dateUpdated": "2026-08-25T05:41:52.464Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted