CVE-2026-74709

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74709", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.927Z", "datePublished": "2026-08-22T15:33:06.558Z", "dateUpdated": "2026-08-22T15:33:06.558Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-22T15:33:06.558Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: clear metadata pointer when no timestamp is requested\n\nUser space can change metadata flags after request processing. Rereading\nthem during completion can therefore make the kernel write a timestamp\nthat was not requested when the packet was submitted.\n\nClear the metadata pointer during request processing unless timestamp\ncompletion is requested. Completion handling can then use the pointer\nitself instead of rereading the flags.\n\nOn the mlx5 multi-packet WQE path metadata is evaluated per batch:\nxsk_tx_metadata_request() runs only for the descriptor that starts a\nsession, just like the checksum offload that is applied once through the\nshared WQE. Only that descriptor's pointer is reset, so completion\nhandling can record a timestamp for the other descriptors of the session\nregardless of their own XDP_TXMD_FLAGS_TIMESTAMP bit. The write stays\ninside the metadata area; the single-WQE, other zero-copy, and generic\npaths reset the pointer per descriptor and are unaffected."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/xdp_sock.h", "net/xdp/xsk.c"], "versions": [{"version": "ca4419f15abd19ba8be1e109661b60f9f5b6c9f0", "lessThan": "0ba2e1eb07a826d021344e2f146b6716c58139eb", "status": "affected", "versionType": "git"}, {"version": "ca4419f15abd19ba8be1e109661b60f9f5b6c9f0", "lessThan": "eb4c613d4ebc3f664e70d572b8867ba114a8754e", "status": "affected", "versionType": "git"}, {"version": "ca4419f15abd19ba8be1e109661b60f9f5b6c9f0", "lessThan": "9f60a67df8d3c862503bee62bada8e7089cba438", "status": "affected", "versionType": "git"}, {"version": "d9d736c416c9a85f84e15435ba82a177262e745b", "status": "affected", "versionType": "git"}, {"version": "6.14.2", "lessThan": "6.15", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/xdp_sock.h", "net/xdp/xsk.c"], "versions": [{"version": "6.15", "status": "affected"}, {"version": "0", "lessThan": "6.15", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.45", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.18.45"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0ba2e1eb07a826d021344e2f146b6716c58139eb"}, {"url": "https://git.kernel.org/stable/c/eb4c613d4ebc3f664e70d572b8867ba114a8754e"}, {"url": "https://git.kernel.org/stable/c/9f60a67df8d3c862503bee62bada8e7089cba438"}], "title": "xsk: clear metadata pointer when no timestamp is requested", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/net/xdp_sock.h", "net/xdp/xsk.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "0ba2e1eb07a826d021344e2f146b6716c58139eb", "status": "affected", "version": "ca4419f15abd19ba8be1e109661b60f9f5b6c9f0", "versionType": "git"}, {"lessThan": "eb4c613d4ebc3f664e70d572b8867ba114a8754e", "status": "affected", "version": "ca4419f15abd19ba8be1e109661b60f9f5b6c9f0", "versionType": "git"}, {"lessThan": "9f60a67df8d3c862503bee62bada8e7089cba438", "status": "affected", "version": "ca4419f15abd19ba8be1e109661b60f9f5b6c9f0", "versionType": "git"}, {"status": "affected", "version": "d9d736c416c9a85f84e15435ba82a177262e745b", "versionType": "git"}, {"lessThan": "6.15", "status": "affected", "version": "6.14.2", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/net/xdp_sock.h", "net/xdp/xsk.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.15"}, {"lessThan": "6.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.45", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: clear metadata pointer when no timestamp is requested\n\nUser space can change metadata flags after request processing. Rereading\nthem during completion can therefore make the kernel write a timestamp\nthat was not requested when the packet was submitted.\n\nClear the metadata pointer during request processing unless timestamp\ncompletion is requested. Completion handling can then use the pointer\nitself instead of rereading the flags.\n\nOn the mlx5 multi-packet WQE path metadata is evaluated per batch:\nxsk_tx_metadata_request() runs only for the descriptor that starts a\nsession, just like the checksum offload that is applied once through the\nshared WQE. Only that descriptor's pointer is reset, so completion\nhandling can record a timestamp for the other descriptors of the session\nregardless of their own XDP_TXMD_FLAGS_TIMESTAMP bit. The write stays\ninside the metadata area; the single-WQE, other zero-copy, and generic\npaths reset the pointer per descriptor and are unaffected."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nxsk: borrar el puntero de metadatos cuando no se solicita una marca de tiempo\n\nEl espacio de usuario puede cambiar los indicadores de metadatos despu\u00e9s del procesamiento de la solicitud. Volver a leerlos durante la finalizaci\u00f3n puede, por lo tanto, hacer que el kernel escriba una marca de tiempo que no fue solicitada cuando el paquete fue enviado.\n\nBorrar el puntero de metadatos durante el procesamiento de la solicitud a menos que se solicite la finalizaci\u00f3n de la marca de tiempo. El manejo de la finalizaci\u00f3n puede entonces usar el propio puntero en lugar de volver a leer los indicadores.\n\nEn la ruta WQE de m\u00faltiples paquetes mlx5, los metadatos son evaluados por lote: xsk_tx_metadata_request() se ejecuta solo para el descriptor que inicia una sesi\u00f3n, al igual que la descarga de suma de verificaci\u00f3n que se aplica una vez a trav\u00e9s del WQE compartido. Solo el puntero de ese descriptor se restablece, por lo que el manejo de la finalizaci\u00f3n puede registrar una marca de tiempo para los otros descriptores de la sesi\u00f3n independientemente de su propio bit XDP_TXMD_FLAGS_TIMESTAMP. La escritura permanece dentro del \u00e1rea de metadatos; las rutas de WQE \u00fanico, otras de copia cero y gen\u00e9ricas restablecen el puntero por descriptor y no se ven afectadas."}], "id": "CVE-2026-74709", "lastModified": "2026-10-14T13:10:00.187", "metrics": {}, "published": "2026-08-22T16:16:45.640", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0ba2e1eb07a826d021344e2f146b6716c58139eb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9f60a67df8d3c862503bee62bada8e7089cba438"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/eb4c613d4ebc3f664e70d572b8867ba114a8754e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: xsk: clear metadata pointer when no timestamp is requested", "id": "2521456", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521456"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-367", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nxsk: clear metadata pointer when no timestamp is requested\nUser space can change metadata flags after request processing. Rereading\nthem during completion can therefore make the kernel write a timestamp\nthat was not requested when the packet was submitted.\nClear the metadata pointer during request processing unless timestamp\ncompletion is requested. Completion handling can then use the pointer\nitself instead of rereading the flags.\nOn the mlx5 multi-packet WQE path metadata is evaluated per batch:\nxsk_tx_metadata_request() runs only for the descriptor that starts a\nsession, just like the checksum offload that is applied once through the\nshared WQE. Only that descriptor's pointer is reset, so completion\nhandling can record a timestamp for the other descriptors of the session\nregardless of their own XDP_TXMD_FLAGS_TIMESTAMP bit. The write stays\ninside the metadata area; the single-WQE, other zero-copy, and generic\npaths reset the pointer per descriptor and are unaffected.", "A flaw was found in the Linux kernel's xsk (AF_XDP sockets) component. A local attacker, by manipulating metadata flags after request processing, could cause the kernel to write a timestamp into the metadata area even when not explicitly requested. This could lead to unintended data modification within the metadata."], "name": "CVE-2026-74709", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74709\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74709\nhttps://lore.kernel.org/linux-cve-announce/2026082237-CVE-2026-74709-bbb2@gregkh/T"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[ca4419f15abd19ba8be1e109661b60f9f5b6c9f0,0ba2e1eb07a826d021344e2f146b6716c58139eb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[ca4419f15abd19ba8be1e109661b60f9f5b6c9f0,eb4c613d4ebc3f664e70d572b8867ba114a8754e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[ca4419f15abd19ba8be1e109661b60f9f5b6c9f0,9f60a67df8d3c862503bee62bada8e7089cba438)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "d9d736c416c9a85f84e15435ba82a177262e745b"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.14.2,6.15)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.15"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.15)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.45,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.9,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-22T19:15:03.627204+00:00", "updated": "2026-08-25T16:30:06.097770+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}