Skip to content
Heist/ feed
Critical

net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry With AF_XDP on a striding RQ, mlx5e defers releasing XSK buffers until an MPWQE is refilled. If XSK allocation then returns -ENOMEM, actual_wq_head is not advanced and a later NAPI poll retries the same WQE. mlx5e_free_rx_mpwqe() leaves each released slot marked as releasable. On retry it can therefore call xsk_buff_free() again through stale pointers after the frames have returned to the XSK pool and been reallocated. Set all skip_release_bitmap bits in the common error path of mlx5e_xsk_alloc_rx_mpwqe(). This matches mlx5e_alloc_rx_mpwqe(). A successful allocation already clears the bitmap after replacing every buffer, so retries become idempotent without changing the success path. Fault injection forced three consecutive failures for one selected MPWQE. Both an early allocation failure and a partial 8-of-16-buffer unwind released the original 16 XSK buffers only once. Each error left a full bitmap, the following NAPI retry skipped the release, and a later successful allocation cleared it. A 20-second AF_XDP zero-copy pressure run exercised 1,575,262 buffer allocation failures without invalid descriptors, WQE errors, or kernel warnings.

Announced Source revision 1
Original source ↗

CVE-2026-99078

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-99078

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "4c2a1323680709078736a2886c754004e9fe42e6",
        "lessThan": "f3a52e2ec2788a7f6b64137985c087188a54ad4f",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "4c2a1323680709078736a2886c754004e9fe42e6",
        "lessThan": "d215d09606b0fcd18ad1eb532995782a21cea49d",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "4c2a1323680709078736a2886c754004e9fe42e6",
        "lessThan": "867119b4b588037724b85839d534465f0334d9bd",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "4c2a1323680709078736a2886c754004e9fe42e6",
        "lessThan": "3d73a1164a8c6b4461907a65cb6c022ea4fd39af",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "4c2a1323680709078736a2886c754004e9fe42e6",
        "lessThan": "63811edf512584c946e5e96b100e9e280703bbb5",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "drivers/net/ethernet/mellanox/mlx5/core/en/xsk/rx.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "6.4"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "6.4",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "6.6.160",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.113",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.57",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "7.2.11",
        "versionType": "semver",
        "lessThanOrEqual": "7.2.*"
      },
      {
        "status": "unaffected",
        "version": "7.3",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "drivers/net/ethernet/mellanox/mlx5/core/en/xsk/rx.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-99078

Source reference: /cveMetadata/cveId

Publisher severity

critical

Source reference: /containers/cna/metrics

Event
#55747 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement