Vulnpedia
← All CVEs

CVE-2026-74560

N/A ALL-YEARS

Published 2026-08-15 · Last modified 2026-10-21 · Linux · NVD: Received

In the Linux kernel, the following vulnerability has been resolved: xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx This patch is inspired by the check[1] from sashiko. It says when overflow happens, the address of cq to be published is invalid. Actually the severer thing is the whole process of publishing the address of cq in this particular case is not right: it should truely publish the address and advance the cached_prod in cq as long as it reads descriptors from txq. The following is the full analysis. xsk_drop_skb() is called in three places, which all discard a partially built multi-buffer skb: 1) xsk_build_skb() -EOVERFLOW error path: packet exceeds MAX_SKB_FRAGS 2) __xsk_generic_xmit() post-loop cleanup: an invalid descriptor in the TX ring prevents the partial packet from completing 3) xsk_release(): socket close while xs->skb holds an incomplete packet In all three cases, the TX descriptors for the already-processed frags have been consumed from the TX ring (xskq_cons_release), and CQ slots have been reserved. However, xsk_drop_skb() calls xsk_consume_skb() which cancels the CQ reservations via xsk_cq_cancel_locked(). Since the buffer addresses never appear in the completion queue, userspace permanently loses track of these buffers. Fix this by letting consume_skb() trigger the existing xsk_destruct_skb destructor, which already submits buffer addresses to the CQ via xsk_cq_submit_addr_locked(). Note that cancelling the descriptors back t

LIMITED SIGNALS

No known exploitation, public exploit, or elevated probability at this time. Track for changes.

Exploitation likelihood

0.2%chance of exploitation in 30 days · 11th percentile

○ In CISA KEV○ Catalogued PoC

Impact if exploited

—CVSS · not scored

  • No impact metrics

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Affected

Vendors Linux

Products Linux

Weakness (CWE)

Not classified.

CVSS vector

Not yet scored.

References and research data (JSON)

Vendor product assessments

Showing 32 of 274 vendor product statements; 242 omitted. Read the full vendor advisory.

  • kernel as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel

    • none available: Fix deferred
    Red Hat · CVE-2026-74560 · Updated 2026-09-01T10:42:52+00:00
  • kernel-64k-modules as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-64k-modules

    • none available: Fix deferred
    Red Hat · CVE-2026-74560 · Updated 2026-09-01T10:42:52+00:00
  • kernel-debug-uki-virt as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-debug-uki-virt

    • none available: Fix deferred
    Red Hat · CVE-2026-74560 · Updated 2026-09-01T10:42:52+00:00
  • kernel-rt-64k-debug-devel as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-rt-64k-debug-devel

    • none available: Fix deferred
    Red Hat · CVE-2026-74560 · Updated 2026-09-01T10:42:52+00:00
  • kernel-rt-debug-kvm as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-rt-debug-kvm

    • none available: Fix deferred
    Red Hat · CVE-2026-74560 · Updated 2026-09-01T10:42:52+00:00
  • kernel-uki-virt as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-uki-virt

    • none available: Fix deferred
    Red Hat · CVE-2026-74560 · Updated 2026-09-01T10:42:52+00:00
  • python3-perf as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/python3-perf

    • none available: Fix deferred
    Red Hat · CVE-2026-74560 · Updated 2026-09-01T10:42:52+00:00
  • kernel-64k-debug-modules-core as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-64k-debug-modules-core

    • none available: Fix deferred
    Red Hat · CVE-2026-74560 · Updated 2026-09-01T10:42:52+00:00
  • kernel-cross-headers as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-cross-headers

    • none available: Fix deferred
    Red Hat · CVE-2026-74560 · Updated 2026-09-01T10:42:52+00:00
  • kernel-devel as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-devel

    • none available: Fix deferred
    Red Hat · CVE-2026-74560 · Updated 2026-09-01T10:42:52+00:00
  • kernel-rt-64k-core as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-rt-64k-core

    • none available: Fix deferred
    Red Hat · CVE-2026-74560 · Updated 2026-09-01T10:42:52+00:00
  • kernel-rt-64k-devel-matched as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-rt-64k-devel-matched

    • none available: Fix deferred
    Red Hat · CVE-2026-74560 · Updated 2026-09-01T10:42:52+00:00
  • kernel-rt-debug-kvm as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-rt-debug-kvm

    • none available: Fix deferred
    Red Hat · CVE-2026-74560 · Updated 2026-09-01T10:42:52+00:00
  • kernel-rt-modules-partner as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-rt-modules-partner

    • none available: Fix deferred
    Red Hat · CVE-2026-74560 · Updated 2026-09-01T10:42:52+00:00
  • kernel-zfcpdump-devel-matched as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-zfcpdump-devel-matched

    • none available: Fix deferred
    Red Hat · CVE-2026-74560 · Updated 2026-09-01T10:42:52+00:00
  • rv as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/rv

    • none available: Fix deferred
    Red Hat · CVE-2026-74560 · Updated 2026-09-01T10:42:52+00:00
  • kernel as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel

    Red Hat · CVE-2026-74560 · Updated 2026-09-01T10:42:52+00:00
  • kernel-doc as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-doc

    Red Hat · CVE-2026-74560 · Updated 2026-09-01T10:42:52+00:00
  • perf as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/perf

    Red Hat · CVE-2026-74560 · Updated 2026-09-01T10:42:52+00:00
  • kernel-debug as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-debug

    Red Hat · CVE-2026-74560 · Updated 2026-09-01T10:42:52+00:00
  • kernel-kdump-devel as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-kdump-devel

    Red Hat · CVE-2026-74560 · Updated 2026-09-01T10:42:52+00:00
  • kernel-rt-doc as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-rt-doc

    Red Hat · CVE-2026-74560 · Updated 2026-09-01T10:42:52+00:00
  • kernel-tools as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-tools

    Red Hat · CVE-2026-74560 · Updated 2026-09-01T10:42:52+00:00
  • bpftool as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/bpftool

    Red Hat · CVE-2026-74560 · Updated 2026-09-01T10:42:52+00:00
  • kernel-cross-headers as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-cross-headers

    Red Hat · CVE-2026-74560 · Updated 2026-09-01T10:42:52+00:00
  • kernel-debug-modules-internal as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-debug-modules-internal

    Red Hat · CVE-2026-74560 · Updated 2026-09-01T10:42:52+00:00
  • kernel-modules-extra as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-modules-extra

    Red Hat · CVE-2026-74560 · Updated 2026-09-01T10:42:52+00:00
  • kernel-rt-debug-devel as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-rt-debug-devel

    Red Hat · CVE-2026-74560 · Updated 2026-09-01T10:42:52+00:00
  • kernel-rt-kvm as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-rt-kvm

    Red Hat · CVE-2026-74560 · Updated 2026-09-01T10:42:52+00:00
  • kernel-selftests-internal as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-selftests-internal

    Red Hat · CVE-2026-74560 · Updated 2026-09-01T10:42:52+00:00
  • kernel-zfcpdump-devel as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-zfcpdump-devel

    Red Hat · CVE-2026-74560 · Updated 2026-09-01T10:42:52+00:00
  • python3-perf as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/python3-perf

    Red Hat · CVE-2026-74560 · Updated 2026-09-01T10:42:52+00:00

References

Advisories

Technical & other

Sources: NVD · CVE.org · All sources and attribution · EPSS