xsk: reclaim invalid Tx descriptors in ZC batch path
In the Linux kernel, the following vulnerability has been resolved: xsk: reclaim invalid Tx descriptors in ZC batch path The zero-copy Tx batch parser stops when it encounters an invalid descriptor. If this happens after one or more continuation descriptors, the Tx consumer can be advanced past fragments that are neither submitted to the driver nor returned to userspace through the completion ring. A similar problem occurs when a packet exceeds xdp_zc_max_segs. The descriptors consumed up to the limit are released without completion, and the remaining continuation descriptors can subsequently be interpreted as the beginning of another packet. Parse Tx batches in packet units and distinguish descriptors belonging to complete valid packets from descriptors consumed while draining an invalid or oversized packet. Return the former to the driver and append the latter to the CQ address area so userspace can reclaim their UMEM frames. Treat a standalone invalid descriptor as a one-descriptor reclaim-only packet. Advancing the Tx-ring consumer releases the ring slot, but does not by itself return ownership of the referenced UMEM frame to userspace. Once draining starts, continue until the packet's end-of-packet descriptor is consumed. Preserve the drain state on the socket when EOP has not yet been supplied, so draining can continue during a later call. Leave incomplete but otherwise valid packets on the Tx ring. Shared-UMEM pools using multi-buffer Tx also need packet-framed parsing
CVE-2026-74558
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-74558
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "cf24f5a5feeaae34c1a34d1e04f8ac697290427a",
"lessThan": "56036bdc445c468b1defd1780ed2af4a3fc7ddb2",
"versionType": "git"
},
{
"status": "affected",
"version": "cf24f5a5feeaae34c1a34d1e04f8ac697290427a",
"lessThan": "2c0a8cc97a9d970a252f17aa0bbf4588768f7aad",
"versionType": "git"
},
{
"status": "affected",
"version": "cf24f5a5feeaae34c1a34d1e04f8ac697290427a",
"lessThan": "e7ce2bad0c33471c8da4dd73dff2119a68f96f3a",
"versionType": "git"
},
{
"status": "affected",
"version": "cf24f5a5feeaae34c1a34d1e04f8ac697290427a",
"lessThan": "72f2b4516faf55d4dfac2414649d3cffa5fd2c5e",
"versionType": "git"
}
],
"programFiles": [
"Documentation/networking/af_xdp.rst",
"include/net/xsk_buff_pool.h",
"net/xdp/xsk.c",
"net/xdp/xsk_buff_pool.c",
"net/xdp/xsk_queue.h"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.6",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver",
"lessThanOrEqual": "7.1.*"
},
{
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"Documentation/networking/af_xdp.rst",
"include/net/xsk_buff_pool.h",
"net/xdp/xsk.c",
"net/xdp/xsk_buff_pool.c",
"net/xdp/xsk_queue.h"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-74558
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #46575 · Revision 1
- Added to Heist Feed
- Publisher date