---
id: CVE-2026-90086
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  xsk: honor XDP_TX_METADATA in zero-copy path

  The zero-copy path reads TX metadata whenever the UMEM has metadata space,
  even if the descriptor does not set XDP_TX_META…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  xsk: honor XDP_TX_METADATA in zero-copy path

  The zero-copy path reads TX metadata whenever the UMEM has metadata space,
  even if the descriptor does not set XDP_TX_META…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 48eb03dd26304c24f03bdbb9382e89c8564e71df <
    53a5b262d706b572840cbe8feae392538077ee19
  - >-
    Linux >= 48eb03dd26304c24f03bdbb9382e89c8564e71df <
    bf9387488d6394845076928c6ca5315ce5d84f54
  - >-
    Linux >= 48eb03dd26304c24f03bdbb9382e89c8564e71df <
    a6e4b9a6deb9362ef7a0706c70d674e92fe1411a
  - Linux 6.8
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:16:58.637'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90086'
references:
  - url: 'https://git.kernel.org/stable/c/53a5b262d706b572840cbe8feae392538077ee19'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a6e4b9a6deb9362ef7a0706c70d674e92fe1411a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/bf9387488d6394845076928c6ca5315ce5d84f54'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.894Z'
epss: 0.00206
epssPercentile: 0.09453
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

xsk: honor XDP_TX_METADATA in zero-copy path

The zero-copy path reads TX metadata whenever the UMEM has metadata space,
even if the descriptor does not set XDP_TX_METADATA. Pass descriptor
options through the metadata helpers and ignore metadata unless the option
is set.

This does not fix the existing per-WQE metadata handling for mlx5 MPWQEs.
Only the descriptor that starts a session passes through
xsk_tx_metadata_request() and configures offload state shared by the batch.
Metadata on descriptors joining an open session is therefore not validated
and does not configure its requested offloads. In addition, a non-NULL
metadata pointer from such a descriptor is treated as a timestamp
completion request even when XDP_TXMD_FLAGS_TIMESTAMP is not set, so its
metadata union can be overwritten with an unrequested timestamp. Fixing
mixed metadata states within one MPWQE requires a separate change.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.