Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: xsk: validate metadata when processing requests The zero-copy path validates TX metadata while obtaining the descriptor context, then reads it again later when preparing the hardware request. User space can change the metadata between those operations and bypass the original validation. Validate the metadata in xsk_tx_metadata_request() and use the resulting flags snapshot for every feature check. Read request fields once so all zero-copy drivers process only values observed after successful validation.
References
- https://git.kernel.org/stable/c/0cc7aa6e0d19027fdd42e6fbd156267ac1e3bbba
- https://git.kernel.org/stable/c/5fd121971912dee2f5af1efec64462ac722deb17
- https://git.kernel.org/stable/c/849b1664dbda1cf6c63e0fd4f9dec23782b8c851
FAQ
What is CVE-2026-74707?
CVE-2026-74707 is a documented vulnerability. In the Linux kernel, the following vulnerability has been resolved: xsk: validate metadata when processing requests The zero-copy path validates TX metadata while obtaining the descriptor context, t...
How severe is CVE-2026-74707?
CVSS scoring is not yet available for CVE-2026-74707. Check NVD for updates.
Is there a patch for CVE-2026-74707?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.