EUVD-2026-64397
GHSA-3mjj-g5w8-p3gp
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
OOB read enables kernel memory disclosure (C:H) and potential panic (A:H), but integrity impact is unconfirmed from a read primitive alone, warranting I:L.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
xsk: require at least 16 bytes of TX metadata
AF_XDP accepts a TX metadata length as small as eight bytes, but every supported request needs the flags plus at least one eight-byte request field. Such short metadata also lets the kernel read beyond the registered area.
Require 16 bytes rather than sizeof(struct xsk_tx_metadata) to preserve compatibility with applications that do not use launch-time metadata.
AnalysisAI
Out-of-bounds kernel memory read in the Linux kernel AF_XDP subsystem allows a local low-privileged user to trigger reads beyond registered memory regions by supplying TX metadata shorter than 16 bytes. Affected systems include Linux kernel versions from the introduction of commit 341ac980eab9 through multiple stable branches, with patches available at 6.12.104, 7.1.9, and 7.2. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local system access with a low-privileged account and the ability to create AF_XDP sockets, which on most default Linux systems requires CAP_NET_RAW or a user network namespace where the attacker has NET_ADMIN. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a local privilege escalation scenario requiring only a low-privileged account and AF_XDP socket access. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker with a low-privileged account and CAP_NET_RAW (or equivalent network namespace privileges) opens an AF_XDP socket and submits a TX metadata buffer of exactly 8 bytes - the previously accepted minimum. The kernel, parsing this undersized metadata as if it contains a full request field, reads 8 bytes beyond the registered UMEM region, potentially disclosing adjacent kernel memory. … |
| Remediation | Upgrade to a patched kernel version: 6.12.104 for the 6.12.x stable branch, 7.1.9 for the 7.1.x stable branch, or 7.2 for the mainline. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux systems running vulnerable kernel versions (any from commit 341ac980eab9 through unpatched stable branches). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today