EUVD-2026-64395
GHSA-qvq6-8jqj-q3p2
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
PR:L reflects CAP_NET_RAW requirement for AF_XDP; AC:L applies to the size-validation path which requires no race timing; full C/I/A justified by kernel memory corruption potential.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
xsk: validate launch-time metadata size
Launch-time metadata extends beyond the first 16 bytes of struct xsk_tx_metadata. Reject the request when the registered metadata area does not contain the complete field.
Snapshot the validated flags for the generic transmit path and use that snapshot for request and completion processing, avoiding inconsistent decisions if user space changes the flags concurrently.
Note that only xsk_skb_metadata is properly using the flags, __xsk_buff_get_metadata ignores them. Next commits address that.
AnalysisAI
Memory corruption in the Linux kernel's AF_XDP socket (xsk) subsystem arises from two related flaws: missing size validation for launch-time metadata fields that extend beyond the first 16 bytes of struct xsk_tx_metadata, and a race condition where user space can modify transmit flags concurrently with kernel transmit processing. A local attacker with low-privilege access who can create and configure AF_XDP sockets may trigger out-of-bounds memory access, leading to high-impact compromise of confidentiality, integrity, and availability consistent with the CVSS 7.8 score. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local access to the target Linux system with at least CAP_NET_RAW capability, or equivalent privileges sufficient to open an AF_XDP socket. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H is internally consistent with the described attack: local access, low privilege, and a straightforward path to kernel out-of-bounds memory access via the size validation flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker with low-privilege access on a Linux system running an XDP-capable network stack opens an AF_XDP socket, enables launch-time metadata, and registers a metadata buffer intentionally sized smaller than the full struct xsk_tx_metadata. When transmit processing is triggered, the kernel accesses memory beyond the registered buffer boundary, potentially corrupting adjacent kernel memory. … |
| Remediation | Upgrade to a patched kernel version: 6.18.45, 7.1.9, or 7.2 depending on the stable branch in use. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory Linux systems and identify any deployments using AF_XDP socket functionality to determine scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today