CVE-2026-74709

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xsk: clear metadata pointer when no timestamp is requested

User space can change metadata flags after request processing. Rereading

them during completion can therefore make the kernel write a timestamp

that was not requested when the packet was submitted.

Clear the metadata pointer during request processing unless timestamp

completion is requested. Completion handling can then use the pointer

itself instead of rereading the flags.

On the mlx5 multi-packet WQE path metadata is evaluated per batch:

xsk_tx_metadata_request() runs only for the descriptor that starts a

session, just like the checksum offload that is applied once through the

shared WQE. Only that descriptor's pointer is reset, so completion

handling can record a timestamp for the other descriptors of the session

regardless of their own XDP_TXMD_FLAGS_TIMESTAMP bit. The write stays

inside the metadata area; the single-WQE, other zero-copy, and generic

pa

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References