CVE-2026-53250

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata()<br /> <br /> The TX metadata area resides in the UMEM buffer which is memory-mapped<br /> and concurrently writable by userspace. In xsk_skb_metadata(),<br /> csum_start and csum_offset are read from shared memory for bounds<br /> validation, then read again for skb assignment. A malicious userspace<br /> application can race to overwrite these values between the two reads,<br /> bypassing the bounds check and causing out-of-bounds memory access<br /> during checksum computation in the transmit path.<br /> <br /> Fix this by reading csum_start and csum_offset into local variables<br /> once, then using the local copies for both validation and assignment.<br /> <br /> Note that other metadata fields (flags, launch_time) and the cached<br /> csum fields may be mutually inconsistent due to concurrent userspace<br /> writes, but this is benign: the only security-critical invariant is<br /> that each field&amp;#39;s validated value is the same one used, which local<br /> caching guarantees.