EUVD-2026-64394
GHSA-qvr7-gw3m-pmf7
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access with low privilege suffices to open AF_XDP sockets and exploit the TOCTOU race via attacker-controlled shared UMEM memory; full kernel-level impact from metadata validation bypass.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
xsk: validate metadata when processing requests
The zero-copy path validates TX metadata while obtaining the descriptor context, then reads it again later when preparing the hardware request. User space can change the metadata between those operations and bypass the original validation.
Validate the metadata in xsk_tx_metadata_request() and use the resulting flags snapshot for every feature check. Read request fields once so all zero-copy drivers process only values observed after successful validation.
AnalysisAI
The AF_XDP zero-copy TX path in the Linux kernel exposes a time-of-check/time-of-use (TOCTOU) race condition that allows a local low-privileged user to bypass TX metadata validation enforced by the kernel. Metadata is validated during descriptor context acquisition but re-read without re-validation when the hardware request is prepared, creating a window during which userspace can overwrite the shared ring buffer entry with arbitrary values. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local code execution on a Linux system where AF_XDP zero-copy TX is in active use. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a locally exploitable vulnerability with full confidentiality, integrity, and availability impact - consistent with a kernel validation bypass that could enable privilege escalation or memory corruption in zero-copy NIC drivers. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A low-privileged local user on a multi-tenant system or container with CAP_NET_ADMIN (or equivalent) creates an AF_XDP socket with the XDP_ZEROCOPY flag and registers a UMEM ring buffer. They submit a TX descriptor with metadata that passes the kernel's initial validation check, then immediately overwrite the shared ring buffer entry with crafted values before the kernel re-reads it during hardware request preparation. … |
| Remediation | The primary remediation is to upgrade to a patched Linux kernel version: 7.2, 7.1.9, or 6.18.45, depending on the stable branch deployed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory systems running AF_XDP and assess which host untrusted user accounts or face local access exposure (critical for telecom, container, and networking infrastructure deployments). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today