In the Linux kernel, the following vulnerability has been resolved: xsk: clear metadata pointer when no timestamp is requested User space can change metadata flags after request processing. Rereading them during completion can therefore make the kernel write a timestamp that was not requested when the packet was submitted. Clear the metadata pointer during request processing unless timestamp completion is requested. Completion handling can then use the pointer itself instead of rereading the flags. On the mlx5 multi-packet WQE path metadata is evaluated per batch: xsk_tx_metadata_request() runs only for the descriptor that starts a session, just like the checksum offload that is applied once through the shared WQE. Only that descriptor's pointer is reset, so completion handling can record a timestamp for the other descriptors of the session regardless of their own XDP_TXMD_FLAGS_TIMESTAMP bit. The write stays inside the metadata area; the single-WQE, other zero-copy, and generic paths reset the pointer per descriptor and are unaffected.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Linux kernel, the following vulnerability has been resolved: xsk: clear metadata pointer when no
    timestamp is requested User space can change metadata flags after request processing. Rereading them
    during completion can therefore make the kernel write a timestamp that was not requested when the packet
    was submitted. Clear the metadata pointer during request processing unless timestamp completion is
    requested. Completion handling can then use the pointer itself instead of rereading the flags. On the mlx5
    multi-packet WQE path metadata is evaluated per batch: xsk_tx_metadata_request() runs only for the
    descriptor that starts a session, just like the checksum offload that is applied once through the shared
    WQE. Only that descriptor's pointer is reset, so completion handling can record a timestamp for the other
    descriptors of the session regardless of their own XDP_TXMD_FLAGS_TIMESTAMP bit. The write stays inside
    the metadata area; the single-WQE, other zero-copy, and generic paths reset the pointer per descriptor and
    are unaffected. (CVE-2026-74709)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - xsk: clear metadata pointer when no timestamp is requested User space can change metadata flags after     request processing. Rereading them during completion can therefore make the kernel write a timestamp that     was not requested when the packet was submitted. Clear the metadata pointer during request processing     unless timestamp completion is requested. Completion handling can then use the pointer itself instead of     rereading the flags. On the mlx5 multi-packet WQE path metadata is evaluated per batch:
    xsk_tx_metadata_request() runs only for the descriptor that starts a session, just like the checksum     offload that is applied once through the shared WQE. Only that descriptor's pointer is reset, so     completion handling can record a timestamp for the other descriptors of the session regardless of their     own XDP_TXMD_FLAGS_TIMESTAMP bit. The write stays inside the metadata area; the single-WQE, other zero-     copy, and generic paths reset the pointer per descriptor and are unaffected. (CVE-2026-74709)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
472196	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 20085.0.0	Tenable Cloud Security	Google COS Security Checks	Local	high
472196	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 20085.0.0	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	high
471868	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.28	Tenable Cloud Security	Google COS Security Checks	Local	high
471868	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.28	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	high
351016	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-3139)	Nessus	Amazon Linux Local Security Checks	Local	critical
338929	Linux Distros Unpatched Vulnerability : CVE-2026-74709	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-74709

high

Tenable Plugins

high

high

high

high

critical

high