CVE-2026-74710: Linux Kernel AF_XDP Privilege Escalation

CVE-2026-74710 Overview

CVE-2026-74710 is a Linux kernel vulnerability in the AF_XDP (xsk) subsystem. The kernel accepts a TX metadata length as small as eight bytes, but every supported request needs the flags field plus at least one eight-byte request field. This short metadata configuration allows the kernel to read beyond the registered memory area during transmit operations. The fix requires a minimum of 16 bytes rather than sizeof(struct xsk_tx_metadata), preserving compatibility with applications that do not use launch-time metadata.

Critical Impact
A local user with the ability to open AF_XDP sockets can trigger the kernel to read past the registered UMEM area, exposing adjacent memory or destabilizing the system.

Affected Products

Linux kernel versions containing the AF_XDP TX metadata handling logic prior to the fix
Distributions shipping vulnerable stable kernel branches referenced by commits 1bb30b1, 21b8536, 642c6e7, and cfb9d29
Systems using AF_XDP sockets for high-performance packet processing

Discovery Timeline

2026-08-22 - CVE-2026-74710 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74710

Vulnerability Analysis

AF_XDP is a Linux socket family designed for high-performance packet I/O directly between userspace and network drivers. TX metadata allows userspace to attach out-of-band information (such as checksum offload or launch-time hints) to packets queued for transmission. This metadata sits in a registered UMEM region before each packet buffer.

The kernel accepted a TX metadata length as small as eight bytes when userspace configured the socket. Every supported metadata request requires a flags field plus at least one eight-byte request field, meaning the minimum functional size is 16 bytes. When userspace registered an eight-byte length, the kernel still attempted to parse the full request structure and read beyond the registered area.

This is an out-of-bounds read [CWE-125] originating in the xsk code path. Because the read reaches memory adjacent to the registered UMEM, it can leak kernel or neighboring user data and may trigger faults depending on the surrounding page layout.

Root Cause

The validation check compared the configured TX metadata length against a value smaller than the minimum needed to satisfy any supported request. The kernel used an eight-byte floor rather than the 16-byte floor required by the on-wire layout of struct xsk_tx_metadata. As a result, a length between eight and 15 bytes passed validation but caused the transmit path to dereference fields outside the buffer.

Attack Vector

An attacker requires local access and the ability to create AF_XDP sockets, which typically means an unprivileged process in an environment where AF_XDP is exposed, or a container with the necessary network capabilities. The attacker registers a UMEM area, configures a TX metadata length of eight to 15 bytes, and submits a TX descriptor that references it. The kernel then reads past the registered region while processing the metadata request, resulting in information disclosure or memory corruption impacting confidentiality, integrity, and availability.

No verified public exploit code is available for this issue. See the upstream stable commits for the corrected validation logic.

Detection Methods for CVE-2026-74710

Indicators of Compromise

Kernel oops or panic messages referencing xsk, xsk_tx_metadata, or AF_XDP transmit paths in dmesg and /var/log/kern.log
Unexpected AF_XDP socket creation by processes that do not normally use AF_XDP, particularly from containers or unprivileged users
KASAN or slab out-of-bounds read reports involving the AF_XDP TX descriptor processing on kernels with sanitizers enabled

Detection Strategies

Audit socket() system calls with domain=AF_XDP (family 44) using auditd or eBPF-based tracing to identify workloads exercising this code path
Correlate AF_XDP socket usage with process lineage to flag sockets opened by shells, interpreters, or short-lived containers
Monitor kernel logs for repeated crashes or warnings on network interfaces where AF_XDP is enabled

Monitoring Recommendations

Track kernel version and patch level across the fleet and alert on hosts still running vulnerable stable branches referenced by commits 1bb30b1, 21b8536, 642c6e7, and cfb9d29
Watch for anomalous XDP program loads (bpf(BPF_PROG_LOAD) with BPF_PROG_TYPE_XDP) alongside AF_XDP socket activity
Ingest kernel telemetry and audit logs into a centralized data lake for retrospective hunting against local privilege escalation patterns

How to Mitigate CVE-2026-74710

Immediate Actions Required

Apply the upstream stable kernel updates that include commits 1bb30b181d9f, 21b8536aee81, 642c6e73fce1, and cfb9d2976b27 from your distribution vendor
Inventory hosts that expose AF_XDP to unprivileged users or containers and prioritize them for patching
Restrict CAP_NET_RAW and CAP_BPF to trusted workloads until patched kernels are deployed

Patch Information

The fix requires at least 16 bytes of TX metadata instead of sizeof(struct xsk_tx_metadata), which both closes the out-of-bounds read and preserves compatibility for applications that do not use launch-time metadata. See the upstream commits: Linux Kernel Commit 1bb30b1, Linux Kernel Commit 21b8536, Linux Kernel Commit 642c6e7, and Linux Kernel Commit cfb9d29.

Workarounds

Disable AF_XDP for untrusted users by using seccomp or LSM policies to block socket(AF_XDP, ...) calls from workloads that do not require it
Remove CAP_NET_RAW and CAP_BPF from container profiles that do not need XDP acceleration
Where AF_XDP is required, ensure userspace registers TX metadata of at least sizeof(struct xsk_tx_metadata) and reject configurations from untrusted sources

bash

# Configuration example: block AF_XDP (family 44) socket creation via seccomp
# Add to a container or systemd unit seccomp profile:
#   SystemCallFilter=~socket
# Or use a JSON seccomp profile fragment:
{
  "syscalls": [
    {
      "names": ["socket"],
      "action": "SCMP_ACT_ERRNO",
      "args": [
        { "index": 0, "value": 44, "op": "SCMP_CMP_EQ" }
      ]
    }
  ]
}