CVE-2026-74709

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> xsk: clear metadata pointer when no timestamp is requested<br /> <br /> User space can change metadata flags after request processing. Rereading<br /> them during completion can therefore make the kernel write a timestamp<br /> that was not requested when the packet was submitted.<br /> <br /> Clear the metadata pointer during request processing unless timestamp<br /> completion is requested. Completion handling can then use the pointer<br /> itself instead of rereading the flags.<br /> <br /> On the mlx5 multi-packet WQE path metadata is evaluated per batch:<br /> xsk_tx_metadata_request() runs only for the descriptor that starts a<br /> session, just like the checksum offload that is applied once through the<br /> shared WQE. Only that descriptor&amp;#39;s pointer is reset, so completion<br /> handling can record a timestamp for the other descriptors of the session<br /> regardless of their own XDP_TXMD_FLAGS_TIMESTAMP bit. The write stays<br /> inside the metadata area; the single-WQE, other zero-copy, and generic<br /> paths reset the pointer per descriptor and are unaffected.