SEPTEMBER 19, 2026
Live Feed
Back to database
Case File

CVE-2026-74708

HIGH · CVSS 7.8 EPSS 0.13%

Source: NVD + CISA KEV + EPSS · Published 2026-08-22 · Last synced 2026-09-18

CyberRota Analysis

AI-Generated

A vulnerability in the Linux kernel affects the xsk (eXpress Socket) implementation, specifically related to the validation of launch-time metadata size, which could allow for improper handling of metadata beyond the first 16 bytes. This flaw may lead to inconsistent processing decisions if user space modifies flags concurrently, potentially compromising system stability or security. Linux system administrators and developers utilizing the xsk interface should prioritize addressing this issue to ensure the integrity and reliability of their applications.

CVE
CVE-2026-74708
Severity
HIGH
CVSS
7.8
EPSS
0.13%
Linux

Original NVD Description

In the Linux kernel, the following vulnerability has been resolved: xsk: validate launch-time metadata size Launch-time metadata extends beyond the first 16 bytes of struct xsk_tx_metadata. Reject the request when the registered metadata area does not contain the complete field. Snapshot the validated flags for the generic transmit path and use that snapshot for request and completion processing, avoiding inconsistent decisions if user space changes the flags concurrently. Note that only xsk_skb_metadata is properly using the flags, __xsk_buff_get_metadata ignores them. Next commits address that.