Bug 2521499 (CVE-2026-74708)

Summary:	CVE-2026-74708 kernel: xsk: validate launch-time metadata size
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's xsk (AF_XDP socket) component. This vulnerability arises from improper validation of launch-time metadata size, where the metadata can extend beyond its allocated structure. This could lead to inconsistent decisions if user space concurrently changes flags, potentially resulting in a denial of service or other undefined behavior.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-22 15:48:32 UTC

In the Linux kernel, the following vulnerability has been resolved:

xsk: validate launch-time metadata size

Launch-time metadata extends beyond the first 16 bytes of struct
xsk_tx_metadata. Reject the request when the registered metadata area does
not contain the complete field.

Snapshot the validated flags for the generic transmit path and use that
snapshot for request and completion processing, avoiding inconsistent
decisions if user space changes the flags concurrently.

Note that only xsk_skb_metadata is properly using the flags,
__xsk_buff_get_metadata ignores them. Next commits address that.

Comment 1 gkamathe 2026-08-24 13:38:18 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026082237-CVE-2026-74708-e2a3@gregkh/T