SB2026082460 - Time-of-check Time-of-use (TOCTOU) Race Condition in Linux kernel xdp

Description

This security bulletin contains information about 1 vulnerability.

1) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-74707)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass metadata validation.

The vulnerability exists due to improper input validation in xsk_tx_metadata_request() and AF_XDP zero-copy TX metadata handling when processing userspace-supplied TX metadata requests. A local user can modify metadata after an initial validation check to bypass metadata validation.

The issue arises because metadata was validated and then read again later, allowing changed values to be observed after the original check in the zero-copy transmit path.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/0cc7aa6e0d19027fdd42e6fbd156267ac1e3bbba
• https://git.kernel.org/stable/c/5fd121971912dee2f5af1efec64462ac722deb17
• https://git.kernel.org/stable/c/849b1664dbda1cf6c63e0fd4f9dec23782b8c851