Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-99057— xen/netfront: don't leak the skb when xennet_fill_frags() fails

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： xen/netfront：在 xennet_fill_frags() 失败时避免 skb 泄漏 当响应链中的槽位数量超过 skb 的 frags（数据片段）所能容纳的数量时，xennet_fill_frags() 会返回错误，xennet_poll() 随即跳转到其错误处理路径。该错误路径会将 tmpq 中剩余的内容移至 errq 以便释放，但此时正在填充的 skb 已从 tmpq 中出队，因此永远不会被释放。每一个溢出的链都会导致该 skb 及其作为 frags 附加

AI Predicted 5.5 Difficulty: Hard EPSS 0.18% · P7

Possible ATT&CK Techniques 1 AI

T1069 · Permission Groups Discovery

Affected Version Matrix 20

VendorProduct Version RangeStatus
Linux Linux ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c< 5051df031144753d3e18862514969146b601d089 affected
ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c< 99011a11c97340ef7290df7dc199305c73fab2f2 affected
ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c< 086944c1c2cbb683543bc3ff08637847b03c8009 affected
ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c< 84e3ea6502b5f14ce8d499d0b6e0e38386274cf0 affected
ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c< 93ccaf1c26e2133396173b76a071e59024daa622 affected
bd1468048aa3e2af865da92990539946d4483989 affected
29a6193c0d74390c004808441061ac1812cf6f51 affected
7eced4478f4ec6ff0a603ddfd6e24a5d3831fca7 affected
… +12 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-99057

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
xen/netfront: don't leak the skb when xennet_fill_frags() fails
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: xen/netfront: don't leak the skb when xennet_fill_frags() fails When a response chain has more slots than fit in the skb's frags, xennet_fill_frags() returns an error and xennet_poll() jumps to its error path. That path moves what's left on tmpq to errq to be freed, but the skb being filled was already dequeued from tmpq, so it's never freed. Each chain that overflows leaks the skb and the pages attached to it as frags, and the backend decides how many slots it sends. Put the skb back on tmpq before taking the error path, like the xennet_set_skb_gso() failure just above it does.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c ~ 5051df031144753d3e18862514969146b601d089 -
Linux Linux 4.19 -

II. Public POCs for CVE-2026-99057

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-99057

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-99057 (5)

Same Patch Batch · Linux · 2026-10-23 · 217 CVEs total

CVE-2026-98959 9.8 CRITICAL btrfs: fix xattr replace when multiple xattrs are packed in the same item
CVE-2026-99078 9.8 CRITICAL net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
CVE-2026-99079 9.8 CRITICAL net/mlx5e: Prevent stale XSK buffer release on refill retry
CVE-2026-98988 8.8 HIGH namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE
CVE-2026-99083 8.8 HIGH ksmbd: fix heap out-of-bounds write in krb5_authenticate()
CVE-2026-99082 8.8 HIGH KVM: x86: Use active memslots for the per-vCPU MMIO cache
CVE-2026-98981 8.8 HIGH namespace: unhash a dentry before detaching the mounts on it
CVE-2026-98980 8.8 HIGH namei: don't reveal overmounted entries in refwalk
CVE-2026-98870 8.8 HIGH ksmbd: remove stale channels from all sessions on teardown
CVE-2026-98978 8.4 HIGH namespace: never expire a locked mount
CVE-2026-99042 8.4 HIGH io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6
CVE-2026-98968 8.1 HIGH amt: send the relay's General Query directly from the receive path
CVE-2026-99064 8.1 HIGH cipso: adjust cached option offsets when removing CIPSO
CVE-2026-99014 7.8 HIGH Bluetooth: hci_sync: Fix command skb lifetime during scan setup
CVE-2026-98999 7.8 HIGH drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin
CVE-2026-99016 7.8 HIGH riscv: futex: untag the user pointer before the atomic access
CVE-2026-99018 7.8 HIGH riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp
CVE-2026-99051 7.8 HIGH fsverity: RCU-delay the freeing of struct fsverity_info
CVE-2026-99054 7.8 HIGH tipc: destroy topsrv workqueues before closing connections
CVE-2026-99053 7.8 HIGH tipc: hold a reference to nodes found by link name

Showing top 20 of 217 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux