CVE-2026-74558

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> xsk: reclaim invalid Tx descriptors in ZC batch path<br /> <br /> The zero-copy Tx batch parser stops when it encounters an invalid<br /> descriptor. If this happens after one or more continuation descriptors,<br /> the Tx consumer can be advanced past fragments that are neither submitted<br /> to the driver nor returned to userspace through the completion ring.<br /> <br /> A similar problem occurs when a packet exceeds xdp_zc_max_segs. The<br /> descriptors consumed up to the limit are released without completion, and<br /> the remaining continuation descriptors can subsequently be interpreted<br /> as the beginning of another packet.<br /> <br /> Parse Tx batches in packet units and distinguish descriptors belonging to<br /> complete valid packets from descriptors consumed while draining an<br /> invalid or oversized packet. Return the former to the driver and append<br /> the latter to the CQ address area so userspace can reclaim their UMEM<br /> frames.<br /> <br /> Treat a standalone invalid descriptor as a one-descriptor reclaim-only<br /> packet. Advancing the Tx-ring consumer releases the ring slot, but does<br /> not by itself return ownership of the referenced UMEM frame to userspace.<br /> <br /> Once draining starts, continue until the packet&amp;#39;s end-of-packet<br /> descriptor is consumed. Preserve the drain state on the socket when EOP<br /> has not yet been supplied, so draining can continue during a later call.<br /> Leave incomplete but otherwise valid packets on the Tx ring.<br /> <br /> Shared-UMEM pools using multi-buffer Tx also need packet-framed parsing.<br /> Walk their Tx sockets one packet at a time, preserving the existing<br /> per-socket fairness scheme, instead of using the legacy one-descriptor<br /> fallback. Keep that fallback for shared pools that do not use<br /> multi-buffer Tx. Since the drain state is maintained per socket and both<br /> the singular and shared paths can resume an interrupted drain, changing<br /> the socket list from singular to shared requires no special bind-time<br /> transition.<br /> <br /> CQ entries are positional, and drivers may complete only part of the Tx<br /> work returned by xsk_tx_peek_release_desc_batch(). Therefore, reclaim-only<br /> entries cannot be published immediately when earlier driver-visible<br /> descriptors are still outstanding.<br /> <br /> Track the number of driver-visible CQ entries preceding the reclaim<br /> entries. Let xsk_tx_completed() publish partial hardware Tx completions,<br /> and publish the reclaim entries only after every earlier Tx descriptor<br /> has completed. Complete a reclaim-only batch immediately when there is no<br /> driver-visible work in front of it, and prevent another Tx batch from<br /> being appended while reclaim entries remain pending.<br /> <br /> Also cap batch processing by the size of the pool&amp;#39;s temporary descriptor<br /> array, as Tx rings belonging to sockets sharing a UMEM may have different<br /> sizes.<br /> <br /> This ensures that every invalid Tx descriptor consumed by the ZC batch<br /> path is either submitted to the driver as part of a valid packet or<br /> returned to userspace without violating CQ completion ordering.