{"api_version":"1","generated_at":"2026-08-22T21:53:00+00:00","cve":"CVE-2026-74707","urls":{"html":"https://cve.report/CVE-2026-74707","api":"https://cve.report/api/cve/CVE-2026-74707.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-74707","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-74707"},"summary":{"title":"xsk: validate metadata when processing requests","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: validate metadata when processing requests\n\nThe zero-copy path validates TX metadata while obtaining the descriptor\ncontext, then reads it again later when preparing the hardware request.\nUser space can change the metadata between those operations and bypass the\noriginal validation.\n\nValidate the metadata in xsk_tx_metadata_request() and use the resulting\nflags snapshot for every feature check. Read request fields once so all\nzero-copy drivers process only values observed after successful\nvalidation.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-22 16:16:45","updated_at":"2026-08-22 16:16:45"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/0cc7aa6e0d19027fdd42e6fbd156267ac1e3bbba","name":"https://git.kernel.org/stable/c/0cc7aa6e0d19027fdd42e6fbd156267ac1e3bbba","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/849b1664dbda1cf6c63e0fd4f9dec23782b8c851","name":"https://git.kernel.org/stable/c/849b1664dbda1cf6c63e0fd4f9dec23782b8c851","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/5fd121971912dee2f5af1efec64462ac722deb17","name":"https://git.kernel.org/stable/c/5fd121971912dee2f5af1efec64462ac722deb17","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-74707","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74707","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ca4419f15abd19ba8be1e109661b60f9f5b6c9f0 5fd121971912dee2f5af1efec64462ac722deb17 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ca4419f15abd19ba8be1e109661b60f9f5b6c9f0 0cc7aa6e0d19027fdd42e6fbd156267ac1e3bbba git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ca4419f15abd19ba8be1e109661b60f9f5b6c9f0 849b1664dbda1cf6c63e0fd4f9dec23782b8c851 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected d9d736c416c9a85f84e15435ba82a177262e745b git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.14.2 6.15 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.15","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.15 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.45 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.9 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/intel/igc/igc_main.c","drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c","drivers/net/ethernet/stmicro/stmmac/stmmac_main.c","include/net/libeth/xsk.h","include/net/xdp_sock_drv.h","net/xdp/xsk_buff_pool.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"5fd121971912dee2f5af1efec64462ac722deb17","status":"affected","version":"ca4419f15abd19ba8be1e109661b60f9f5b6c9f0","versionType":"git"},{"lessThan":"0cc7aa6e0d19027fdd42e6fbd156267ac1e3bbba","status":"affected","version":"ca4419f15abd19ba8be1e109661b60f9f5b6c9f0","versionType":"git"},{"lessThan":"849b1664dbda1cf6c63e0fd4f9dec23782b8c851","status":"affected","version":"ca4419f15abd19ba8be1e109661b60f9f5b6c9f0","versionType":"git"},{"status":"affected","version":"d9d736c416c9a85f84e15435ba82a177262e745b","versionType":"git"},{"lessThan":"6.15","status":"affected","version":"6.14.2","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/intel/igc/igc_main.c","drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c","drivers/net/ethernet/stmicro/stmmac/stmmac_main.c","include/net/libeth/xsk.h","include/net/xdp_sock_drv.h","net/xdp/xsk_buff_pool.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.15"},{"lessThan":"6.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.45","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.9","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.45","versionStartIncluding":"6.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.9","versionStartIncluding":"6.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2","versionStartIncluding":"6.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.14.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: validate metadata when processing requests\n\nThe zero-copy path validates TX metadata while obtaining the descriptor\ncontext, then reads it again later when preparing the hardware request.\nUser space can change the metadata between those operations and bypass the\noriginal validation.\n\nValidate the metadata in xsk_tx_metadata_request() and use the resulting\nflags snapshot for every feature check. Read request fields once so all\nzero-copy drivers process only values observed after successful\nvalidation."}],"providerMetadata":{"dateUpdated":"2026-08-22T15:33:05.337Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/5fd121971912dee2f5af1efec64462ac722deb17"},{"url":"https://git.kernel.org/stable/c/0cc7aa6e0d19027fdd42e6fbd156267ac1e3bbba"},{"url":"https://git.kernel.org/stable/c/849b1664dbda1cf6c63e0fd4f9dec23782b8c851"}],"title":"xsk: validate metadata when processing requests","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-74707","datePublished":"2026-08-22T15:33:05.337Z","dateReserved":"2026-08-15T05:44:03.927Z","dateUpdated":"2026-08-22T15:33:05.337Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-22 16:16:45","lastModifiedDate":"2026-08-22 16:16:45","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"74707","Ordinal":"1","Title":"xsk: validate metadata when processing requests","CVE":"CVE-2026-74707","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"74707","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: validate metadata when processing requests\n\nThe zero-copy path validates TX metadata while obtaining the descriptor\ncontext, then reads it again later when preparing the hardware request.\nUser space can change the metadata between those operations and bypass the\noriginal validation.\n\nValidate the metadata in xsk_tx_metadata_request() and use the resulting\nflags snapshot for every feature check. Read request fields once so all\nzero-copy drivers process only values observed after successful\nvalidation.","Type":"Description","Title":"xsk: validate metadata when processing requests"}]}}}