CVE-2026-74707: xsk: validate metadata when processing requests
In the Linux kernel, the following vulnerability has been resolved:
xsk: validate metadata when processing requests
The zero-copy path validates TX metadata while obtaining the descriptor context, then reads it again later when preparing the hardware request. User space can change the metadata between those operations and bypass the original validation.
Validate the metadata in xsktxmetadatarequest() and use the resulting flags snapshot for every feature check. Read request fields once so all zero-copy drivers process only values observed after successful validation.
Affected Software
Event History
Frequently Asked Questions
What access is needed to exploit this issue?
An attacker needs the ability to submit zero-copy transmit requests from user space and modify TX metadata after it has initially been validated but before the hardware request is prepared.
Which systems are exposed?
The issue affects the Linux kernel zero-copy transmit path, including zero-copy drivers that process TX metadata for hardware requests. Systems not using that path are not described as affected by the provided information.
What does the fix change?
The fix validates metadata in xsk_tx_metadata_request(), snapshots the resulting flags for all feature checks, and reads request fields once after successful validation. This prevents user space from changing metadata between validation and request preparation.