CVE-2026-74708: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-74708 Overview

CVE-2026-74708 affects the Linux kernel's AF_XDP socket (XSK) implementation. The vulnerability stems from missing validation of launch-time metadata size in the transmit path. Launch-time metadata extends beyond the first 16 bytes of struct xsk_tx_metadata, and the kernel previously accepted requests where the registered metadata area did not contain the complete field.

A related concurrency issue allowed user space to change metadata flags between request submission and completion processing. This produced inconsistent decisions in the generic transmit path.

Critical Impact
A local, low-privileged attacker with access to AF_XDP sockets can trigger out-of-bounds memory access in the kernel, leading to memory corruption, denial of service, or local privilege escalation.

Affected Products

Linux kernel versions containing the XSK launch-time metadata feature prior to the fix commits
Distributions shipping stable kernel branches that had not yet backported commits 439ce2dddf3d, af511afa1d29, and bc63d47611c0
Systems exposing AF_XDP sockets to unprivileged or containerized workloads

Discovery Timeline

2026-08-22 - CVE-2026-74708 published to the National Vulnerability Database
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74708

Vulnerability Analysis

The flaw resides in the AF_XDP (XSK) transmit metadata handling code. AF_XDP is a high-performance socket family that gives user space direct access to network device queues through shared memory regions called UMEMs. Applications describe transmit metadata using struct xsk_tx_metadata, and the kernel reads that structure from user-controlled memory during transmit processing.

Launch-time metadata is an extension that occupies bytes beyond the first 16 bytes of the structure. The kernel accepted transmit requests without confirming that the registered metadata area was large enough to contain the extended field. When the field extended past the end of the mapped region, the kernel accessed memory outside the intended bounds.

A second defect involved concurrent flag mutation. The generic transmit path read the metadata flags multiple times across request submission and completion. User space could change those flags between reads, causing the kernel to make inconsistent decisions about which metadata to process.

Root Cause

The root cause is missing input validation on the size of the registered metadata region combined with a Time-of-Check Time-of-Use (TOCTOU) pattern on user-writable flag fields. The kernel trusted the descriptor without verifying that the mapped area contained the complete xsk_tx_metadata structure, including launch-time fields. It also re-read mutable flags rather than snapshotting them.

Attack Vector

A local attacker with permission to create AF_XDP sockets registers a UMEM whose metadata region is deliberately undersized. The attacker then submits transmit descriptors that reference launch-time metadata offsets falling outside the registered area. Concurrently, a second thread races the flags field to trigger inconsistent processing between the request and completion paths. Successful exploitation can corrupt kernel memory or induce kernel state inconsistencies. See the kernel commits referenced below for the authoritative technical description.

No verified exploit code is publicly available. The vulnerability is described in prose based on the upstream commit messages.

Detection Methods for CVE-2026-74708

Indicators of Compromise

Unexpected kernel warnings, BUG: messages, or KASAN reports referencing xsk_tx_metadata, xsk_skb_metadata, or __xsk_buff_get_metadata in dmesg and journalctl -k output
Non-privileged processes creating AF_XDP sockets and registering unusually small UMEM metadata regions
Kernel crashes or soft lockups on hosts where untrusted workloads have CAP_NET_RAW or AF_XDP access

Detection Strategies

Audit workloads permitted to open AF_XDP sockets using seccomp, LSM, or eBPF-based syscall telemetry
Correlate kernel oops and panic events with the process context that most recently invoked setsockopt on an XDP socket
Compare running kernel commit identifiers against the fix commits 439ce2dddf3d, af511afa1d29, and bc63d47611c0

Monitoring Recommendations

Forward /dev/kmsg and audit logs to a central data lake and alert on kernel memory corruption signatures
Track container and pod escalation attempts that follow AF_XDP socket creation on shared hosts
Monitor for repeated short-lived processes issuing socket(AF_XDP, ...) followed by mmap of small UMEM regions

How to Mitigate CVE-2026-74708

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the Kernel Patch Commitment, Kernel Commit Details, and Kernel Change Log Entry
Update to distribution kernels that include the metadata size validation fix
Restrict AF_XDP socket creation to trusted workloads using capability controls and seccomp policies

Patch Information

The fix is implemented across three upstream kernel commits. The change rejects transmit requests when the registered metadata area does not contain the complete launch-time field. It also snapshots the validated flags for the generic transmit path so that request and completion processing use consistent values, closing the concurrent-mutation window. Note that only xsk_skb_metadata uses the snapshotted flags; __xsk_buff_get_metadata still ignores them and is addressed in follow-up commits.

Workarounds

Remove CAP_NET_RAW and CAP_SYS_ADMIN from container profiles that do not require raw network access
Disable AF_XDP by omitting CONFIG_XDP_SOCKETS when rebuilding custom kernels for environments that do not use it
Apply seccomp filters that block socket(AF_XDP, ...) for untrusted user IDs and container runtimes

bash

# Verify AF_XDP socket family exposure and running kernel version
uname -r
grep CONFIG_XDP_SOCKETS /boot/config-$(uname -r)

# Example seccomp fragment to deny AF_XDP socket creation (pseudo-policy)
# Deny: syscall=socket, arg0=AF_XDP (44)