CVE-2026-74709

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the xsk component where user space can modify metadata flags after request processing. If the kernel rereads these flags during completion, it may write a timestamp that was not originally requested during packet submission. In the mlx5 multi-packet WQE (Work Queue Element) path, metadata is evaluated per batch, and the xsk tx metadata request() function runs only for the descriptor starting a session. Consequently, only that descriptor's pointer is reset, allowing completion handling to record timestamps for other descriptors in the session regardless of their XDP TXMD FLAGS TIMESTAMP bit. This results in a write operation within the metadata area.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.