CVE-2026-74559 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
xsk: drain continuation descs after overflow in xsk_build_skb()
Fix generic xmit path multi-buffer logic when packets are either too big (count of descriptors exceed MAX_SKB_FRAGS) or an invalid descriptor is included in fragmented packet. Introduce xdp_sock::drain_cont and act upon this flag - when it is set, keep on consuming descriptors from AF_XDP Tx ring and put them directly onto Cq. Previously these descriptors were silently lost and could never be reached again.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability described represents a critical flaw in the Linux kernel's AF_XDP implementation that affects the xsk_build_skb() function and the underlying socket operations. This issue specifically impacts the handling of packet transmission through the generic xmit path where multi-buffer logic fails to properly manage descriptor overflow conditions. The problem manifests when packets exceed the maximum number of fragments allowed by MAX_SKB_FRAGS or when invalid descriptors are present within fragmented packets, creating a scenario where descriptor management becomes inconsistent and potentially leads to data loss.
The technical root cause lies in how the kernel handles the continuation descriptor processing during packet assembly operations. When overflow conditions occur in the xsk_build_skb() function, the system should maintain proper state tracking to ensure all available descriptors are processed and accounted for. However, prior to this fix, the implementation failed to drain continuation descriptors from the AF_XDP Tx ring when overflow conditions were detected, resulting in a silent loss of descriptor information that could never be recovered or processed by subsequent operations.
This vulnerability directly relates to CWE-129 and CWE-787 within the Common Weakness Enumeration framework, representing issues with improper input validation and out-of-bounds memory access patterns. The flaw creates potential for packet loss and can impact network performance and reliability in systems utilizing AF_XDP for high-speed packet processing. From an adversarial perspective, this vulnerability could potentially be exploited to cause denial of service conditions or data corruption in network applications that depend on AF_XDP functionality.
The operational impact of this vulnerability extends across various network stack components that rely on AF_XDP for fast packet transmission and reception. Systems utilizing AF_XDP for high-performance networking, including those implementing XDP programs for packet filtering, classification, or forwarding, may experience silent packet loss during overflow conditions. This can particularly affect applications in data center environments, network function virtualization deployments, or any infrastructure requiring low-latency packet processing where descriptor management is critical.
The mitigation strategy implemented in this fix introduces a new flag xdp_sock::drain_cont that enables proper handling of continuation descriptors when overflow conditions occur. This approach ensures that all available descriptors are consumed from the AF_XDP Tx ring and properly placed onto the completion queue rather than being silently lost. The solution aligns with ATT&CK techniques related to privilege escalation and resource exhaustion by ensuring proper cleanup and state management during error conditions. Network administrators should apply this kernel update immediately to prevent potential packet loss scenarios that could impact service availability or data integrity in systems utilizing AF_XDP functionality for high-speed packet processing operations.