{"api_version":"1","generated_at":"2026-08-22T21:53:01+00:00","cve":"CVE-2026-74708","urls":{"html":"https://cve.report/CVE-2026-74708","api":"https://cve.report/api/cve/CVE-2026-74708.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-74708","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-74708"},"summary":{"title":"xsk: validate launch-time metadata size","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: validate launch-time metadata size\n\nLaunch-time metadata extends beyond the first 16 bytes of struct\nxsk_tx_metadata. Reject the request when the registered metadata area does\nnot contain the complete field.\n\nSnapshot the validated flags for the generic transmit path and use that\nsnapshot for request and completion processing, avoiding inconsistent\ndecisions if user space changes the flags concurrently.\n\nNote that only xsk_skb_metadata is properly using the flags,\n__xsk_buff_get_metadata ignores them. Next commits address that.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-22 16:16:45","updated_at":"2026-08-22 16:16:45"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/439ce2dddf3d22129b9113a7881637256a35e936","name":"https://git.kernel.org/stable/c/439ce2dddf3d22129b9113a7881637256a35e936","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/af511afa1d2977f384044df78d6fbf9fba653f7a","name":"https://git.kernel.org/stable/c/af511afa1d2977f384044df78d6fbf9fba653f7a","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/bc63d47611c07b0d5d655fe1a590861931527920","name":"https://git.kernel.org/stable/c/bc63d47611c07b0d5d655fe1a590861931527920","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-74708","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74708","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ca4419f15abd19ba8be1e109661b60f9f5b6c9f0 af511afa1d2977f384044df78d6fbf9fba653f7a git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ca4419f15abd19ba8be1e109661b60f9f5b6c9f0 bc63d47611c07b0d5d655fe1a590861931527920 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ca4419f15abd19ba8be1e109661b60f9f5b6c9f0 439ce2dddf3d22129b9113a7881637256a35e936 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected d9d736c416c9a85f84e15435ba82a177262e745b git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.14.2 6.15 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.15","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.15 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.45 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.9 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/net/xdp_sock_drv.h","net/xdp/xsk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"af511afa1d2977f384044df78d6fbf9fba653f7a","status":"affected","version":"ca4419f15abd19ba8be1e109661b60f9f5b6c9f0","versionType":"git"},{"lessThan":"bc63d47611c07b0d5d655fe1a590861931527920","status":"affected","version":"ca4419f15abd19ba8be1e109661b60f9f5b6c9f0","versionType":"git"},{"lessThan":"439ce2dddf3d22129b9113a7881637256a35e936","status":"affected","version":"ca4419f15abd19ba8be1e109661b60f9f5b6c9f0","versionType":"git"},{"status":"affected","version":"d9d736c416c9a85f84e15435ba82a177262e745b","versionType":"git"},{"lessThan":"6.15","status":"affected","version":"6.14.2","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["include/net/xdp_sock_drv.h","net/xdp/xsk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.15"},{"lessThan":"6.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.45","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.9","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.45","versionStartIncluding":"6.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.9","versionStartIncluding":"6.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2","versionStartIncluding":"6.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.14.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: validate launch-time metadata size\n\nLaunch-time metadata extends beyond the first 16 bytes of struct\nxsk_tx_metadata. Reject the request when the registered metadata area does\nnot contain the complete field.\n\nSnapshot the validated flags for the generic transmit path and use that\nsnapshot for request and completion processing, avoiding inconsistent\ndecisions if user space changes the flags concurrently.\n\nNote that only xsk_skb_metadata is properly using the flags,\n__xsk_buff_get_metadata ignores them. Next commits address that."}],"providerMetadata":{"dateUpdated":"2026-08-22T15:33:05.956Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/af511afa1d2977f384044df78d6fbf9fba653f7a"},{"url":"https://git.kernel.org/stable/c/bc63d47611c07b0d5d655fe1a590861931527920"},{"url":"https://git.kernel.org/stable/c/439ce2dddf3d22129b9113a7881637256a35e936"}],"title":"xsk: validate launch-time metadata size","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-74708","datePublished":"2026-08-22T15:33:05.956Z","dateReserved":"2026-08-15T05:44:03.927Z","dateUpdated":"2026-08-22T15:33:05.956Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-22 16:16:45","lastModifiedDate":"2026-08-22 16:16:45","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"74708","Ordinal":"1","Title":"xsk: validate launch-time metadata size","CVE":"CVE-2026-74708","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"74708","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: validate launch-time metadata size\n\nLaunch-time metadata extends beyond the first 16 bytes of struct\nxsk_tx_metadata. Reject the request when the registered metadata area does\nnot contain the complete field.\n\nSnapshot the validated flags for the generic transmit path and use that\nsnapshot for request and completion processing, avoiding inconsistent\ndecisions if user space changes the flags concurrently.\n\nNote that only xsk_skb_metadata is properly using the flags,\n__xsk_buff_get_metadata ignores them. Next commits address that.","Type":"Description","Title":"xsk: validate launch-time metadata size"}]}}}