CVE-2026-90086 xsk: honor XDP_TX_METADATA in zero-copy path
A flaw in the Linux kernel's XDP zero-copy path allows unrequested timestamp overwrites in TX metadata, potentially corrupting data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-90086?
CVE-2026-90086 is a vulnerability in Linux, published on 17 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
xsk: honor XDP_TX_METADATA in zero-copy path
The zero-copy path reads TX metadata whenever the UMEM has metadata space, even if the descriptor does not set XDP_TX_METADATA. Pass descriptor options through the metadata helpers and ignore metadata unless the option is set.
This does not fix the existing per-WQE metadata handling for mlx5 MPWQEs. Only the descriptor that starts a session passes through xsk_tx_metadata_request() and configures offload state shared by the batch. Metadata on descriptors joining an open session is therefore not validated and does not configure its requested offloads. In addition, a non-NULL metadata pointer from such a descriptor is treated as a timestamp completion request even when XDP_TXMD_FLAGS_TIMESTAMP is not set, so its metadata union can be overwritten with an unrequested timestamp. Fixing mixed metadata states within one MPWQE requires a separate change.
Which versions are affected by CVE-2026-90086?
How do I fix CVE-2026-90086?
Apply the vendor's patch.
Is CVE-2026-90086 being exploited?
There is no known exploitation of CVE-2026-90086 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-90086, DEBIAN-CVE-2026-90086, GHSA-5vhq-jqrp-ph25, UBUNTU-CVE-2026-90086.