CVE-2026-74560

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A buffer leak exists in the xsk drop skb() function during AF XDP multi-buffer Tx operations. The issue occurs when a partially built multi-buffer skb is discarded in three scenarios: when a packet exceeds MAX SKB FRAGS in xsk build skb(), during post-loop cleanup in xsk generic xmit() due to an invalid descriptor in the TX ring, or during socket closure in xsk release(). In these cases, xsk drop skb() calls xsk consume skb(), which cancels completion queue (CQ) reservations via xsk cq cancel locked(). Because the buffer addresses are not published to the completion queue, userspace permanently loses track of these buffers. The fix involves allowing consume skb() to trigger the xsk destruct skb() destructor to properly submit buffer addresses to the CQ via xsk cq submit addr locked().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.