Look up another CVE · open CVE-2026-74710 in the interactive tracker
CVE-2026-74710
xsk: require at least 16 bytes of TX metadata
Published 2026-08-22 (2 months ago) by the Linux kernel CNA. Subsystem net/xdp. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-74710 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | fixedDSA-6466-1 · 2026-08-25 · text | 6.12.105-1 | Update the kernel and reboot. DSA-6466-1 shipped the fix on 2026-08-25, in 6.12.105-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.9-1 | Update the kernel and reboot. Fixed in 7.1.9-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.9-1 | Update the kernel and reboot. Fixed in 7.1.9-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4788-1 · 2026-09-19 · text | 6.12.107-1~deb12u1 | Update the kernel and reboot. DLA-4788-1 shipped the fix on 2026-09-19, in 6.12.107-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
AF_XDP accepts a TX metadata length as small as eight bytes, but every supported request needs the flags plus at least one eight-byte request field. Such short metadata also lets the kernel read beyond the registered area. Require 16 bytes rather than sizeof(struct xsk_tx_metadata) to preserve compatibility with applications that do not use launch-time metadata.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/xdp/xdp_umem.c
- What this is
- XDP SOCKETS (AF_XDP)MAINTAINERS section matched on net/xdp/ · netdev@vger.kernel.org · Maintained
Check it on the machine
grep -w CONFIG_XDP_SOCKETS /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sid, bookworm · linux-6.12y
- y
- built into the kernel image on every flavour - only a patch removes it
- Build switch
- CONFIG_XDP_SOCKETS
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-22 (2 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.13%, higher than 2.2% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- net/xdp
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.8 | 6.12.104 | 21b8536aee81 |
| 6.8 | 6.18.45 | 642c6e73fce1 |
| 6.8 | 7.1.9 | cfb9d2976b27 |
| 6.8 | 7.2 | 1bb30b181d9f |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4788-1 | 2026-09-19 | bookworm 6.12.107-1~deb12u1 | tracker |
| DSA-6466-1 | 2026-08-25 | trixie 6.12.105-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The bug is reached only through local AF_XDP setup—socket(AF_XDP), setsockopt(XDP_UMEM_REG) with tx_metadata_len=8, ring configuration, bind, and TX descriptor submission—not via remote packet handling or network-facing services.
- AC:LAttack complexity, low
- The attacker fully controls tx_metadata_len, descriptor addresses, metadata flags, and TX timing, and can place frames at chunk boundaries to reliably trigger kernel reads/writes past the declared 8-byte metadata headroom.
- PR:LPrivileges required, low
- AF_XDP socket creation requires CAP_NET_RAW (xsk_create()); per kernel CNA guidance this is Low because unprivileged processes can obtain it inside user/network namespaces (e.g., unshare -Urn).
- UI:NUser interaction, none
- No victim action is required; the attacker configures their own AF_XDP socket, UMEM, rings, and TX descriptors to trigger the faulty metadata handling during transmit.
- S:UScope, unchanged
- Impact is confined to kernel processing of attacker-supplied AF_XDP metadata and pinned UMEM frames; it does not cross VM, hypervisor, or IOMMU isolation boundaries.
- C:HConfidentiality impact, high
- With only 8 bytes registered, the kernel still dereferences xsk_tx_metadata request fields (checksum, launch time) beyond the metadata area; this out-of-bounds read can cross chunk/UMEM boundaries and expose adjacent memory.
- I:HIntegrity impact, high
- TX timestamp completion writes through meta->completion.tx_timestamp when only 8 bytes of metadata were reserved, causing an out-of-bounds write past the registered metadata headroom that can corrupt adjacent memory or be leveraged further.
- A:HAvailability impact, high
- Reading or writing metadata fields beyond the registered length at chunk/UMEM edges can access unmapped pages and trigger kernel faults; out-of-bounds kernel accesses in this path can cause oops/panic-level denial of service.