{"id":"CVE-2026-90086","revision":"ada17193931d4d9c9324de5eaa94a392","records":[{"revision":"ada17193931d4d9c9324de5eaa94a392","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-90086","aliases":[],"title":"xsk: honor XDP_TX_METADATA in zero-copy path","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: honor XDP_TX_METADATA in zero-copy path\n\nThe zero-copy path reads TX metadata whenever the UMEM has metadata space,\neven if the descriptor does not set XDP_TX_METADATA. Pass descriptor\noptions through the metadata helpers and ignore metadata unless the option\nis set.\n\nThis does not fix the existing per-WQE metadata handling for mlx5 MPWQEs.\nOnly the descriptor that starts a session passes through\nxsk_tx_metadata_request() and configures offload state shared by the batch.\nMetadata on descriptors joining an open session is therefore not validated\nand does not configure its requested offloads. In addition, a non-NULL\nmetadata pointer from such a descriptor is treated as a timestamp\ncompletion request even when XDP_TXMD_FLAGS_TIMESTAMP is not set, so its\nmetadata union can be overwritten with an unrequested timestamp. Fixing\nmixed metadata states within one MPWQE requires a separate change.","state":0,"publishedAt":"2026-09-17T16:06:02.212+00:00","modifiedAt":"2026-10-21T12:49:45.759+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/ethernet/intel/igc/igc_main.c\",\n                        \"drivers/net/ethernet/mellanox/mlx5/core/en/xsk/tx.c\",\n                        \"drivers/net/ethernet/stmicro/stmmac/stmmac_main.c\",\n                        \"include/net/libeth/xsk.h\",\n                        \"include/net/xdp_sock_drv.h\",\n                        \"include/net/xsk_buff_pool.h\",\n                        \"net/xdp/xsk_buff_pool.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"48eb03dd26304c24f03bdbb9382e89c8564e71df\",\n                            \"lessThan\": \"8ba0d143e471c85f8a116707c0b42bf046b0a7b3\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"48eb03dd26304c24f03bdbb9382e89c8564e71df\",\n                            \"lessThan\": \"53a5b262d706b572840cbe8feae392538077ee19\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"48eb03dd26304c24f03bdbb9382e89c8564e71df\",\n                            \"lessThan\": \"bf9387488d6394845076928c6ca5315ce5d84f54\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"48eb03dd26304c24f03bdbb9382e89c8564e71df\",\n                            \"lessThan\": \"a6e4b9a6deb9362ef7a0706c70d674e92fe1411a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/ethernet/intel/igc/igc_main.c\",\n                        \"drivers/net/ethernet/mellanox/mlx5/core/en/xsk/tx.c\",\n                        \"drivers/net/ethernet/stmicro/stmmac/stmmac_main.c\",\n                        \"include/net/libeth/xsk.h\",\n                        \"include/net/xdp_sock_drv.h\",\n                        \"include/net/xsk_buff_pool.h\",\n                        \"net/xdp/xsk_buff_pool.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.8\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.8\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.114\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.52\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.6\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/8ba0d143e471c85f8a116707c0b42bf046b0a7b3","https://git.kernel.org/stable/c/53a5b262d706b572840cbe8feae392538077ee19","https://git.kernel.org/stable/c/bf9387488d6394845076928c6ca5315ce5d84f54","https://git.kernel.org/stable/c/a6e4b9a6deb9362ef7a0706c70d674e92fe1411a"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-90086","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-90086","identifiers":["CVE-2026-90086"]},"retained":false,"historicalAffected":[]}],"coverage":[]}