CVE-2026-74710

A flaw was found in the Linux kernel's AF_XDP (eXpress Data Path) component. This vulnerability arises because the AF_XDP mechanism accepts a transmit (TX) metadata length that is smaller than required, allowing the kernel to read beyond its designated memory area. An attacker could potentially exploit this out-of-bounds read to gain unauthorized access to sensitive information, leading to information disclosure.

This vulnerability is rated as Moderate impact because exploitation requires local access with elevated privileges, such as the capability to create raw network sockets, significantly limiting exposure in default deployments. A privileged user could supply undersized transmission metadata during AF_XDP socket configuration, triggering an out-of-bounds memory read. In practice, this flaw may cause kernel instability resulting in a local denial of service or potentially leak uninitialized kernel memory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.