Missing Release of Resource after Effective Lifetime in Linux kernel - CVE-2026-74560

Vulnerability identifier: #VU143219

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-74560

CWE-ID: CWE-772

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in xsk_drop_skb() for AF_XDP multi-buffer transmission when discarding a partially built multi-buffer skb. A local user can trigger error paths with invalid or oversized descriptors to cause a denial of service.

The issue occurs when processed transmit descriptors are consumed and completion queue slots are reserved, but the corresponding buffer addresses are not published to the completion queue, causing userspace to permanently lose track of those buffers.

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-aws (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux (Ubuntu package) - update to 7.0.0-42.42
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17

• https://git.kernel.org/stable/c/05e283466b86e0b25a5209a3eafe87aa9886064a
• https://git.kernel.org/stable/c/a0528ab6af62bf57153caaf8ea28e5fcb0e18fd4
• https://git.kernel.org/stable/c/a3c8382ebce4780c6b3ace2c09bc342313ac0186

• Missing Release of Resource after Effective Lifetime in Linux kernel xdp
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more