CVE-2026-74708High· 7.8▾ Twilight

In the Linux kernel, the following vulnerability has been resolved: xsk: validate launch-time metadata size Launch-time metadata extends beyond the first 16 bytes of struct xsk_tx_metadata

In the Linux kernel, the following vulnerability has been resolved: xsk: validate launch-time metadata size Launch-time metadata extends beyond the first 16 bytes of struct xsk_tx_metadata. Reject the request when the registered metada…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score43/ 100 · Moderate

impact 42.9 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Aug 22, 2026

Updated

Oct 14, 2026

CVSS

7.8

Vendor

Linux

Product

Linux

CWE

—

Depth score

43 · Moderate

EPSS

0.17% · p7

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

decided 2026-10-16

Exploitation: none
Automatable: no
Technical impact: total

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

EPSS history

Exploit-prediction probability, daily snapshots since Oct 14.

0.2% → 0.2%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 53 days

Aug 22, 2026Published
Disclosed via NVD
Oct 14, 2026Record revised
Last analysed / modified upstream
Oct 14, 2026EPSS first tracked
0.2%

Linux #nvd #cve.org

Affected

Linux >= ca4419f15abd19ba8be1e109661b60f9f5b6c9f0 < af511afa1d2977f384044df78d6fbf9fba653f7a
Linux >= ca4419f15abd19ba8be1e109661b60f9f5b6c9f0 < bc63d47611c07b0d5d655fe1a590861931527920
Linux >= ca4419f15abd19ba8be1e109661b60f9f5b6c9f0 < 439ce2dddf3d22129b9113a7881637256a35e936
Linux d9d736c416c9a85f84e15435ba82a177262e745b
Linux >= 6.14.2 < 6.15
Linux 6.15

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

xsk: validate launch-time metadata size

Launch-time metadata extends beyond the first 16 bytes of struct xsk_tx_metadata. Reject the request when the registered metadata area does not contain the complete field.

Snapshot the validated flags for the generic transmit path and use that snapshot for request and completion processing, avoiding inconsistent decisions if user space changes the flags concurrently.

Note that only xsk_skb_metadata is properly using the flags, __xsk_buff_get_metadata ignores them. Next commits address that.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#cve.org

← Back to feed

CVE-2026-74708High· 7.8▾ Twilight

In the Linux kernel, the following vulnerability has been resolved: xsk: validate launch-time metadata size Launch-time metadata extends beyond the first 16 bytes of struct xsk_tx_metadata

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score43/ 100 · Moderate

impact 42.9 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Aug 22, 2026

Updated

Oct 14, 2026

CVSS

7.8

Vendor

Linux

Product

Linux

CWE

—

Depth score

43 · Moderate

EPSS

0.17% · p7

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

decided 2026-10-16

Exploitation: none
Automatable: no
Technical impact: total

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

EPSS history

Exploit-prediction probability, daily snapshots since Oct 14.

0.2% → 0.2%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 53 days

Aug 22, 2026Published
Disclosed via NVD
Oct 14, 2026Record revised
Last analysed / modified upstream
Oct 14, 2026EPSS first tracked
0.2%

Linux #nvd #cve.org

Affected

Linux >= ca4419f15abd19ba8be1e109661b60f9f5b6c9f0 < af511afa1d2977f384044df78d6fbf9fba653f7a
Linux >= ca4419f15abd19ba8be1e109661b60f9f5b6c9f0 < bc63d47611c07b0d5d655fe1a590861931527920
Linux >= ca4419f15abd19ba8be1e109661b60f9f5b6c9f0 < 439ce2dddf3d22129b9113a7881637256a35e936
Linux d9d736c416c9a85f84e15435ba82a177262e745b
Linux >= 6.14.2 < 6.15
Linux 6.15

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

xsk: validate launch-time metadata size

Launch-time metadata extends beyond the first 16 bytes of struct xsk_tx_metadata. Reject the request when the registered metadata area does not contain the complete field.

Snapshot the validated flags for the generic transmit path and use that snapshot for request and completion processing, avoiding inconsistent decisions if user space changes the flags concurrently.

Note that only xsk_skb_metadata is properly using the flags, __xsk_buff_get_metadata ignores them. Next commits address that.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#cve.org