CVE-2026-74558

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the zero-copy (ZC) Tx batch path where the parser stops upon encountering an invalid descriptor. If this occurs after continuation descriptors, the Tx consumer may advance past fragments that are neither submitted to the driver nor returned to userspace via the completion ring. A similar issue occurs when a packet exceeds xdp zc max segs, causing descriptors consumed up to the limit to be released without completion, which may lead to remaining continuation descriptors being misinterpreted as the start of a new packet. The fix involves parsing Tx batches in packet units to distinguish valid packets from those being drained due to being invalid or oversized. It also ensures that reclaim-only entries are published only after all preceding driver-visible Tx descriptors have completed to maintain completion ring (CQ) ordering.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.