CVE-2026-74708

A flaw was found in the Linux kernel's xsk (AF_XDP socket) component. This vulnerability arises from improper validation of launch-time metadata size, where the metadata can extend beyond its allocated structure. This could lead to inconsistent decisions if user space concurrently changes flags, potentially resulting in a denial of service or other undefined behavior.

This Low security impact flaw in the Linux kernel's AF_XDP (xsk) transmit metadata handling affects Red Hat Enterprise Linux and Red Hat In-Vehicle OS. When an application requests the launch-time transmit metadata flag (XDP_TXMD_FLAGS_LAUNCH_TIME), the kernel does not validate that the registered metadata area is large enough to contain the complete launch-time field, so the transmit path can read metadata from bytes outside the declared metadata area. In addition, because the validated flags are not snapshotted for the generic transmit path, concurrent changes to the flags by user space can result in inconsistent request and completion processing. Exploitation requires a local process with access to an AF_XDP socket and its user memory (UMEM) metadata setup; the issue is not network reachable, and Red Hat's analysis found no clear evidence of kernel memory corruption, privilege escalation, or a system-wide crash, with the impact limited to incorrect transmit metadata handling and potential denial of service (Red Hat CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). This is lower than the upstream CVE severity of Important (CVSS 3.1 score 7.8), which assumes high confidentiality and integrity impact that Red Hat's analysis of this local, availability-limited issue does not support. Red Hat Enterprise Linux 9.8 and 9.9 (kernel and kernel-rt), Red Hat Enterprise Linux 10.2 and 10.3 (kernel), and Red Hat In-Vehicle OS 2 (kernel and kernel-ivos-qualcomm) contain the vulnerable code and are affected; Red Hat Enterprise Linux 6, 7, 8, 9 (through 9.6), and 10.0 streams do not include the launch-time metadata offload feature (vulnerable code not present) and are not affected. Because of the Low security impact and the local access requirements, fixes for the affected streams are deferred to a future update; the residual risk is that a local user able to configure AF_XDP transmit metadata could trigger incorrect metadata processing or a denial of service, but not system-wide compromise.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.