CVE-2026-99078 (GCVE-0-2026-99078)
Vulnerability from cvelistv5
Published
2026-10-23 12:23
Modified
2026-10-24 14:10
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
With AF_XDP on a striding RQ, mlx5e defers releasing XSK buffers until
an MPWQE is refilled. If XSK allocation then returns -ENOMEM,
actual_wq_head is not advanced and a later NAPI poll retries the same
WQE.
mlx5e_free_rx_mpwqe() leaves each released slot marked as releasable. On
retry it can therefore call xsk_buff_free() again through stale pointers
after the frames have returned to the XSK pool and been reallocated.
Set all skip_release_bitmap bits in the common error path of
mlx5e_xsk_alloc_rx_mpwqe(). This matches mlx5e_alloc_rx_mpwqe(). A
successful allocation already clears the bitmap after replacing every
buffer, so retries become idempotent without changing the success path.
Fault injection forced three consecutive failures for one selected MPWQE.
Both an early allocation failure and a partial 8-of-16-buffer unwind
released the original 16 XSK buffers only once. Each error left a full
bitmap, the following NAPI retry skipped the release, and a later
successful allocation cleared it. A 20-second AF_XDP zero-copy pressure
run exercised 1,575,262 buffer allocation failures without invalid
descriptors, WQE errors, or kernel warnings.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en/xsk/rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f3a52e2ec2788a7f6b64137985c087188a54ad4f",
"status": "affected",
"version": "4c2a1323680709078736a2886c754004e9fe42e6",
"versionType": "git"
},
{
"lessThan": "d215d09606b0fcd18ad1eb532995782a21cea49d",
"status": "affected",
"version": "4c2a1323680709078736a2886c754004e9fe42e6",
"versionType": "git"
},
{
"lessThan": "867119b4b588037724b85839d534465f0334d9bd",
"status": "affected",
"version": "4c2a1323680709078736a2886c754004e9fe42e6",
"versionType": "git"
},
{
"lessThan": "3d73a1164a8c6b4461907a65cb6c022ea4fd39af",
"status": "affected",
"version": "4c2a1323680709078736a2886c754004e9fe42e6",
"versionType": "git"
},
{
"lessThan": "63811edf512584c946e5e96b100e9e280703bbb5",
"status": "affected",
"version": "4c2a1323680709078736a2886c754004e9fe42e6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en/xsk/rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry\n\nWith AF_XDP on a striding RQ, mlx5e defers releasing XSK buffers until\nan MPWQE is refilled. If XSK allocation then returns -ENOMEM,\nactual_wq_head is not advanced and a later NAPI poll retries the same\nWQE.\n\nmlx5e_free_rx_mpwqe() leaves each released slot marked as releasable. On\nretry it can therefore call xsk_buff_free() again through stale pointers\nafter the frames have returned to the XSK pool and been reallocated.\n\nSet all skip_release_bitmap bits in the common error path of\nmlx5e_xsk_alloc_rx_mpwqe(). This matches mlx5e_alloc_rx_mpwqe(). A\nsuccessful allocation already clears the bitmap after replacing every\nbuffer, so retries become idempotent without changing the success path.\n\nFault injection forced three consecutive failures for one selected MPWQE.\nBoth an early allocation failure and a partial 8-of-16-buffer unwind\nreleased the original 16 XSK buffers only once. Each error left a full\nbitmap, the following NAPI retry skipped the release, and a later\nsuccessful allocation cleared it. A 20-second AF_XDP zero-copy pressure\nrun exercised 1,575,262 buffer allocation failures without invalid\ndescriptors, WQE errors, or kernel warnings."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - Routable IP packets received by mlx5 consume the AF_XDP striding RQ through mlx5e_completion_event() -\u003e mlx5e_napi_poll() -\u003e mlx5e_poll_rx_cq(), after which mlx5e_napi_xsk_post() -\u003e mlx5e_post_rx_mpwqes() reaches patched mlx5e_xsk_alloc_rx_mpwqe(); packet pressure exhausts the RX/Fill rings and triggers the stale-buffer retry.\nAC:L - A sender can flood the XSK-bound RSS queue until XDP redirect and refill allocation fail, then continue traffic so NAPI retries the unchanged actual_wq_head; no uncontrolled race is needed for mlx5e_free_rx_mpwqe() to release the stale pointer.\nPR:N - The receive path beginning at mlx5e_completion_event() performs no authentication or capability check; xsk_create()\u0027s CAP_NET_RAW requirement applies to victim-side AF_XDP provisioning, while the remote IP sender needs no privileges.\nUI:N - Once an mlx5 AF_XDP zero-copy pool and XDP program are running, packet receipt, mlx5e_napi_xsk_post(), and the refill retries occur automatically without further victim action.\nS:U - The corrupted xsk_buff_pool metadata and mlx5 receive state belong to the host kernel; the bug crosses no VM, IOMMU, or other security-authority boundary.\nC:H - In unaligned-UMEM mode, duplicate live xdp_buff_xsk ownership lets repeated successful __xsk_rcv_zc() calls make xp_release() write kernel pointers past the pool\u0027s flexible free_heads[] array; this heap corruption can be leveraged to disclose arbitrary kernel memory.\nI:H - The same xp_release() overflow is an out-of-bounds kernel heap write; subsequent xp_get_xskb() trusts pointers popped from corrupted free_heads[] and initializes through them, supporting arbitrary writes or control-flow corruption.\nA:H - Overflowing free_heads[] or later dereferencing a bogus xskb in xp_get_xskb() can oops or panic; even without a crash, duplicate UMEM ownership can prevent mlx5e_xsk_alloc_rx_mpwqe() from restoring WQEs and stop the bound receive queue."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-24T14:10:20.145Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f3a52e2ec2788a7f6b64137985c087188a54ad4f"
},
{
"url": "https://git.kernel.org/stable/c/d215d09606b0fcd18ad1eb532995782a21cea49d"
},
{
"url": "https://git.kernel.org/stable/c/867119b4b588037724b85839d534465f0334d9bd"
},
{
"url": "https://git.kernel.org/stable/c/3d73a1164a8c6b4461907a65cb6c022ea4fd39af"
},
{
"url": "https://git.kernel.org/stable/c/63811edf512584c946e5e96b100e9e280703bbb5"
}
],
"title": "net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99078",
"datePublished": "2026-10-23T12:23:25.542Z",
"dateReserved": "2026-09-25T10:25:14.389Z",
"dateUpdated": "2026-10-24T14:10:20.145Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…