SB20260816150 - Missing Release of Resource after Effective Lifetime in Linux kernel xdp

Description

This security bulletin contains information about 1 vulnerability.

1) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-74560)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in xsk_drop_skb() for AF_XDP multi-buffer transmission when discarding a partially built multi-buffer skb. A local user can trigger error paths with invalid or oversized descriptors to cause a denial of service.

The issue occurs when processed transmit descriptors are consumed and completion queue slots are reserved, but the corresponding buffer addresses are not published to the completion queue, causing userspace to permanently lose track of those buffers.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/05e283466b86e0b25a5209a3eafe87aa9886064a
• https://git.kernel.org/stable/c/a0528ab6af62bf57153caaf8ea28e5fcb0e18fd4
• https://git.kernel.org/stable/c/a3c8382ebce4780c6b3ace2c09bc342313ac0186