High 7.8Published Aug 22, 2026

CVE-2026-74708xsk: validate launch-time metadata size

Updated under an hour ago (2026-10-19 07:00 UTC)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: xsk: validate launch-time metadata size Launch-time metadata extends beyond the first 16 bytes of struct xsk_tx_metadata. Reject the request when the registered metadata area does not contain the complete field. Snapshot the validated flags for the generic transmit path and use that snapshot for request and completion processing, avoiding inconsistent decisions if user space changes the flags concurrently. Note that only xsk_skb_metadata is properly using the flags, __xsk_buff_get_metadata ignores them. Next commits address that.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 16, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from ca4419f15abd19ba8be1e109661b60f9f5b6c9f0 before af511afa1d2977f384044df78d6fbf9fba653f7a; from ca4419f15abd19ba8be1e109661b60f9f5b6c9f0 before bc63d47611c07b0d5d655fe1a590861931527920; from ca4419f15abd19ba8be1e109661b60f9f5b6c9f0 before 439ce2dddf3d22129b9113a7881637256a35e936; d9d736c416c9a85f84e15435ba82a177262e745b; from 6.14.2 before 6.15	CNA record

References

https://git.kernel.org/stable/c/af511afa1d2977f384044df78d6fbf9fba653f7a
https://git.kernel.org/stable/c/bc63d47611c07b0d5d655fe1a590861931527920
https://git.kernel.org/stable/c/439ce2dddf3d22129b9113a7881637256a35e936

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.