CVE-2026-74707

A flaw was found in the Linux kernel's xsk (AF_XDP sockets) component. This vulnerability allows a local user to bypass security validation by modifying transmission (TX) metadata after it has been initially checked but before it is used to prepare hardware requests. This could lead to unexpected system behavior or potentially impact data integrity.

AF_XDP zero copy TX metadata is validated while descriptor context is obtained, but the same user controlled metadata can be read again later when the driver prepares the hardware request. A local user controlling an AF_XDP UMEM can race the validation window and change flags or request fields after the first validation, which can bypass checks for TX metadata features such as launch time, timestamp, or checksum offload. For the CVSS the PR:L value is used because reliable triggering requires local code execution and access to an AF_XDP socket or a delegated networking context, not full host root privileges. The issue is not directly network reachable. Impact is at least validation bypass with possible malformed TX offload requests, packet integrity effects, driver or NIC error paths, and local denial of service. There is no direct evidence of a UAF or OOB write primitive in this patch, so the base score keeps C:N and only limited integrity and availability impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.