CVE-2026-74558

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xsk: reclaim invalid Tx descriptors in ZC batch path

The zero-copy Tx batch parser stops when it encounters an invalid

descriptor. If this happens after one or more continuation descriptors,

the Tx consumer can be advanced past fragments that are neither submitted

to the driver nor returned to userspace through the completion ring.

A similar problem occurs when a packet exceeds xdp_zc_max_segs. The

descriptors consumed up to the limit are released without completion, and

the remaining continuation descriptors can subsequently be interpreted

as the beginning of another packet.

Parse Tx batches in packet units and distinguish descriptors belonging to

complete valid packets from descriptors consumed while draining an

invalid or oversized packet. Return the former to the driver and append

the latter to the CQ address area so userspace can reclaim their UMEM

frames.

Treat a standalone invalid descriptor as a one-descri

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References