Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: xsk: require at least 16 bytes of TX metadata AF_XDP accepts a TX metadata… (CVE-2026-74710)

The Linux kernel's AF_XDP interface previously accepted TX metadata lengths as small as eight bytes, despite every supported request requiring flags plus at least one eight-byte request field, totaling at least 16 bytes. Accepting shorter metadata allowed the kernel to read beyond the registered memory area, potentially leading to memory corruption or information disclosure. The vulnerability was fixed by enforcing a minimum TX metadata length of 16 bytes, aligning with the size of struct xsk_tx_metadata and preserving compatibility with applications that do not use launch-time metadata.

This vulnerability could lead to the kernel reading beyond the allocated memory area for TX metadata, potentially causing memory corruption, information disclosure, or other undefined behavior. The CVSS score of 7.8 indicates a high impact on confidentiality, integrity, and availability, but the attack vector is local with low privileges required.

A fix has been implemented in the Linux kernel to require at least 16 bytes of TX metadata for AF_XDP. Users should apply the official kernel updates that include this fix. Since this is a kernel-level vulnerability, updating to the patched kernel version is the recommended remediation. No additional mitigations are indicated.