CVE-2026-74708

CVE CVE-2026-74708EUVD EUVD-2026-64395Published 2026-08-22T15:33:05.000ZLast changed 2026-08-25T05:41:51.000ZCVSS 7.8

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: xsk: validate launch-time metadata size Launch-time metadata extends beyond the first 16 bytes of struct xsk_tx_metadata. Reject the request when the registered metadata area does not contain the complete field. Snapshot the validated flags for the generic transmit path and use that snapshot for request and completion processing, avoiding inconsistent decisions if user space changes the flags concurrently. Note that only xsk_skb_metadata is properly using the flags, __xsk_buff_get_metadata ignores them. Next commits address that.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

Linux — Linux d9d736c416c9a85f84e15435ba82a177262e745b; patch: 6.18.45; ca4419f15abd19ba8be1e109661b60f9f5b6c9f0 <bc63d47611c07b0d5d655fe1a590861931527920; ca4419f15abd19ba8be1e109661b60f9f5b6c9f0 <af511afa1d2977f384044df78d6fbf9fba653f7a; patch: 7.1.9; patch: 0; 6.14.2 <6.15; 6.15; ca4419f15abd19ba8be1e109661b60f9f5b6c9f0 <439ce2dddf3d22129b9113a7881637256a35e936; patch: 7.2

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

Linux — Linux

Does this concern one of your customers?

This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.

Try it for 28 days

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.