CVE-2026-74710xsk: require at least 16 bytes of TX metadata
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: xsk: require at least 16 bytes of TX metadata AF_XDP accepts a TX metadata length as small as eight bytes, but every supported request needs the flags plus at least one eight-byte request field. Such short metadata also lets the kernel read beyond the registered area. Require 16 bytes rather than sizeof(struct xsk_tx_metadata) to preserve compatibility with applications that do not use launch-time metadata.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 341ac980eab90ac1f6c22ee9f9da83ed9604d899 builds before 21b8536aee819792f1b4b38b9aacf2a073025d49; from 341ac980eab90ac1f6c22ee9f9da83ed9604d899 before 642c6e73fce17fdca93a5793c4d22359fda866d7; from 341ac980eab90ac1f6c22ee9f9da83ed9604d899 before cfb9d2976b277e554e28c165e3eff4b4a8ea10bd; 341ac980eab90ac1f6c22ee9f9da83ed9604d899 builds before 1bb30b181d9f0484e141f8411e15ed906d5c6780 | CNA record |
References
- https://git.kernel.org/stable/c/21b8536aee819792f1b4b38b9aacf2a073025d49
- https://git.kernel.org/stable/c/642c6e73fce17fdca93a5793c4d22359fda866d7
- https://git.kernel.org/stable/c/cfb9d2976b277e554e28c165e3eff4b4a8ea10bd
- https://git.kernel.org/stable/c/1bb30b181d9f0484e141f8411e15ed906d5c6780
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.