CVE-2026-74560

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx

This patch is inspired by the check[1] from sashiko. It says when

overflow happens, the address of cq to be published is invalid.

Actually the severer thing is the whole process of publishing the

address of cq in this particular case is not right: it should truely

publish the address and advance the cached_prod in cq as long as it

reads descriptors from txq.

The following is the full analysis.

xsk_drop_skb() is called in three places, which all discard a partially

built multi-buffer skb:

1) xsk_build_skb() -EOVERFLOW error path: packet exceeds MAX_SKB_FRAGS

2) __xsk_generic_xmit() post-loop cleanup: an invalid descriptor in

the TX ring prevents the partial packet from completing

3) xsk_release(): socket close while xs->skb holds an incomplete packet

In all three cases, the TX descriptors for the already-processed frags

have been consumed from the

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References