CVE-2026-99028 (GCVE-0-2026-99028)
Vulnerability from cvelistv5
Published
2026-10-23 12:21
Modified
2026-10-23 12:21
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop In the dmaengine path the driver pre-submits RX buffers and holds in-flight TX buffers whose SKBs are DMA-mapped by the driver and freed only in the completion callbacks. On ndo_stop() dmaengine_terminate_sync() aborts these descriptors without running their callbacks, and the driver then frees only the ring shells, leaking every SKB still owned by the engine and its DMA mapping on each ifdown. With 128 RX buffers pre-posted per channel, the mapping leak can eventually exhaust a limited IOMMU aperture. Clear the slot's skb in the TX and RX callbacks so a non-NULL skb marks a slot that still owns a live, DMA-mapped buffer, and on stop unmap and free every such buffer. axienet_dma_rx_cb() runs from the DMA tasklet and re-arms the RX ring on each completion, so it can race axienet_stop(): a completion may submit a fresh buffer after dmaengine_terminate_sync() has returned, leaving the channel armed with a buffer the teardown then frees while the engine may still write into it (dma_release_channel() does not stop it either). Add a lock that axienet_dma_rx_cb() holds across the @stopping check and the resubmit, and axienet_stop() holds to set @stopping before terminating. Once @stopping is set no callback can arm a new buffer, and any armed just before is aborted by the terminate, so teardown only frees buffers the engine no longer owns.
References
Impacted products
Vendor Product Version
Linux Linux Version: 6a91b846af85a24241decd686269e8e038eb13d1
Version: 6a91b846af85a24241decd686269e8e038eb13d1
Version: 6a91b846af85a24241decd686269e8e038eb13d1
Version: 6a91b846af85a24241decd686269e8e038eb13d1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/xilinx/xilinx_axienet.h",
            "drivers/net/ethernet/xilinx/xilinx_axienet_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "079396129da5e7cb40ca0920aa1b9525bef6097c",
              "status": "affected",
              "version": "6a91b846af85a24241decd686269e8e038eb13d1",
              "versionType": "git"
            },
            {
              "lessThan": "eececf7c3a679d9c08175ad6bacbc8c31848f5af",
              "status": "affected",
              "version": "6a91b846af85a24241decd686269e8e038eb13d1",
              "versionType": "git"
            },
            {
              "lessThan": "5e5cf3ad7c099ff86ea9e422cddb25a2e5317b58",
              "status": "affected",
              "version": "6a91b846af85a24241decd686269e8e038eb13d1",
              "versionType": "git"
            },
            {
              "lessThan": "bcf2573a68a808a5b54cadafa72b6672e662c2bf",
              "status": "affected",
              "version": "6a91b846af85a24241decd686269e8e038eb13d1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/xilinx/xilinx_axienet.h",
            "drivers/net/ethernet/xilinx/xilinx_axienet_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.58",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.114",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.58",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.11",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop\n\nIn the dmaengine path the driver pre-submits RX buffers and holds\nin-flight TX buffers whose SKBs are DMA-mapped by the driver and freed\nonly in the completion callbacks. On ndo_stop() dmaengine_terminate_sync()\naborts these descriptors without running their callbacks, and the driver\nthen frees only the ring shells, leaking every SKB still owned by the\nengine and its DMA mapping on each ifdown. With 128 RX buffers pre-posted\nper channel, the mapping leak can eventually exhaust a limited IOMMU\naperture.\n\nClear the slot\u0027s skb in the TX and RX callbacks so a non-NULL skb marks a\nslot that still owns a live, DMA-mapped buffer, and on stop unmap and free\nevery such buffer.\n\naxienet_dma_rx_cb() runs from the DMA tasklet and re-arms the RX ring on\neach completion, so it can race axienet_stop(): a completion may submit a\nfresh buffer after dmaengine_terminate_sync() has returned, leaving the\nchannel armed with a buffer the teardown then frees while the engine may\nstill write into it (dma_release_channel() does not stop it either). Add a\nlock that axienet_dma_rx_cb() holds across the @stopping check and the\nresubmit, and axienet_stop() holds to set @stopping before terminating.\nOnce @stopping is set no callback can arm a new buffer, and any armed just\nbefore is aborted by the terminate, so teardown only frees buffers the\nengine no longer owns."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-23T12:21:20.294Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/079396129da5e7cb40ca0920aa1b9525bef6097c"
        },
        {
          "url": "https://git.kernel.org/stable/c/eececf7c3a679d9c08175ad6bacbc8c31848f5af"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e5cf3ad7c099ff86ea9e422cddb25a2e5317b58"
        },
        {
          "url": "https://git.kernel.org/stable/c/bcf2573a68a808a5b54cadafa72b6672e662c2bf"
        }
      ],
      "title": "net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-99028",
    "datePublished": "2026-10-23T12:21:20.294Z",
    "dateReserved": "2026-09-25T10:25:14.386Z",
    "dateUpdated": "2026-10-23T12:21:20.294Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.