CVE-2026-74710: xsk: require at least 16 bytes of TX metadata
In the Linux kernel, the following vulnerability has been resolved:
xsk: require at least 16 bytes of TX metadata
AFXDP accepts a TX metadata length as small as eight bytes, but every supported request needs the flags plus at least one eight-byte request field. Such short metadata also lets the kernel read beyond the registered area.
Require 16 bytes rather than sizeof(struct xsktxmetadata) to preserve compatibility with applications that do not use launch-time metadata.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Change AF_XDP to require a TX metadata length of at least 16 bytes rather than accepting as small as 8 bytes (sizeof(struct xsk_tx_metadata), where applicable) so the kernel does not read beyond the registered area and to preserve compatibility with applications that do not use launch-time metadata.
Linux kernel AF_XDP/xsk TX metadata handling AF_XDP TX metadata length minimum = Require at least 16 bytes (instead of allowing 8 bytes / sizeof(struct xsk_tx_metadata) where applicable)
Event History
Frequently Asked Questions
What condition identifies an affected AF_XDP configuration?
An affected configuration registers TX metadata shorter than 16 bytes. Supported TX metadata requests require flags plus at least one eight-byte request field, so 16 bytes is the minimum valid size.
What is the consequence of using undersized TX metadata?
Metadata as short as eight bytes can cause the kernel to read beyond the registered metadata area. The resolved behavior rejects TX metadata lengths below 16 bytes.
Will the minimum-size check break applications that do not use launch-time metadata?
The fix requires 16 bytes rather than sizeof(struct xsk_tx_metadata) specifically to preserve compatibility with applications that do not use launch-time metadata.