CVE-2026-90086 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
xsk: honor XDP_TX_METADATA in zero-copy path
The zero-copy path reads TX metadata whenever the UMEM has metadata space, even if the descriptor does not set XDP_TX_METADATA. Pass descriptor options through the metadata helpers and ignore metadata unless the option is set.
This does not fix the existing per-WQE metadata handling for mlx5 MPWQEs. Only the descriptor that starts a session passes through xsk_tx_metadata_request() and configures offload state shared by the batch. Metadata on descriptors joining an open session is therefore not validated and does not configure its requested offloads. In addition, a non-NULL metadata pointer from such a descriptor is treated as a timestamp completion request even when XDP_TXMD_FLAGS_TIMESTAMP is not set, so its metadata union can be overwritten with an unrequested timestamp. Fixing mixed metadata states within one MPWQE requires a separate change.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel networking subsystem contains a specific vulnerability in the zero-copy path of the AF_XDP implementation that results in unintended behavior regarding transmission metadata handling. This issue arises when the User Memory Area (UMEM) is configured with space for metadata, causing the system to read TX metadata from descriptors even if those descriptors do not explicitly set the XDP_TX_METADATA flag. The core technical flaw lies in the failure of the zero-copy path to strictly honor descriptor options before passing them through metadata helpers. Instead of validating whether the XDP_TX_METADATA option is actually set on a per-descriptor basis, the implementation proceeds with reading and processing metadata unconditionally whenever the UMEM supports it. This lack of strict validation allows descriptors that do not request specific offloads or metadata operations to inadvertently trigger metadata processing logic, leading to potential state corruption or incorrect configuration of hardware offload features.
The operational impact of this vulnerability is primarily related to data integrity and predictable network behavior in high-performance packet processing scenarios. When a descriptor does not set XDP_TX_METADATA but the UMEM has metadata space enabled, the system may still attempt to process associated metadata fields. This can lead to situations where unrequested timestamp completions are processed or where metadata unions are overwritten with unintended values, such as timestamps that were never requested by the application. In environments utilizing Mellanox ConnectX adapters with Multi-Path Work Queue Entries (MPWQEs), this flaw is particularly pronounced because only the descriptor initiating a session passes through the xsk_tx_metadata_request function to configure shared offload state. Subsequent descriptors joining an open session do not have their metadata requests validated, meaning they operate under potentially stale or incorrect configuration assumptions. This can result in network packets being processed with incorrect timestamps or metadata states, which may disrupt applications relying on precise timing information for latency measurement, packet classification, or synchronization purposes.
From a vulnerability taxonomy perspective, this issue aligns with CWE-20 Improper Input Validation and CWE-94 Improper Control of Generation of Code (Code Injection) in the context of unintended code execution paths triggered by malformed descriptor states. The failure to validate that XDP_TX_METADATA is set before processing metadata represents a classic input validation error where the system assumes valid intent based on structural availability rather than explicit flags. In terms of MITRE ATT&CK, this could be categorized under T1059 Command and Scripting Interpreter if an attacker were able to manipulate descriptor states in a way that causes unintended side effects, although it is more accurately described as a logic error leading to resource mismanagement or state confusion rather than direct exploitation for code execution. The vulnerability highlights the complexity of zero-copy networking where performance optimizations often bypass standard validation layers, increasing the risk of subtle bugs affecting system stability and security posture.
Mitigation strategies involve applying kernel patches that enforce strict checking of descriptor options before invoking metadata helpers. Developers must ensure that XDP_TX_METADATA is explicitly set on a per-descriptor basis for any operation requiring metadata processing. For systems using Mellanox hardware with MPWQEs, it is critical to recognize that the current fix only addresses individual descriptors and does not resolve mixed metadata states within a single batched work queue entry. Therefore, administrators should monitor for updates addressing the broader session-level state management issues. Until such fixes are applied, applications relying on precise timestamping or specific offload configurations via AF_XDP zero-copy paths should exercise caution and consider implementing additional validation layers in user-space to ensure that only intended descriptors trigger metadata processing logic. Regularly updating the Linux kernel to versions containing these corrections is essential for maintaining the integrity of high-performance network stacks.