Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-99078— net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： net/mlx5e：防止在 MPWQE 填充重试时释放过期的 XSK 缓冲区 当在采用 striding RQ（环形队列）的 AF_XDP 场景下使用时，mlx5e 驱动会推迟释放 XSK 缓冲区，直到 MPWQE（多包工作队列条目）被重新填充。如果此时 XSK 缓冲区分配返回 （内存不足），则 指针不会被推进，导致后续的 NAPI 轮询重试同一个 WQE（工作队列条目）。 函数会将每个已释放的槽位标记为“可释放”。因此，在重试过程中，该函数可能通过已失效的指针再次调用

AI Predicted 5.5 Difficulty: Hard

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 12

VendorProduct Version RangeStatus
Linux Linux 4c2a1323680709078736a2886c754004e9fe42e6< f3a52e2ec2788a7f6b64137985c087188a54ad4f affected
4c2a1323680709078736a2886c754004e9fe42e6< d215d09606b0fcd18ad1eb532995782a21cea49d affected
4c2a1323680709078736a2886c754004e9fe42e6< 867119b4b588037724b85839d534465f0334d9bd affected
4c2a1323680709078736a2886c754004e9fe42e6< 3d73a1164a8c6b4461907a65cb6c022ea4fd39af affected
4c2a1323680709078736a2886c754004e9fe42e6< 63811edf512584c946e5e96b100e9e280703bbb5 affected
6.4 affected
< 6.4 unaffected
6.6.160≤ 6.6.* unaffected
… +4 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-99078

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry With AF_XDP on a striding RQ, mlx5e defers releasing XSK buffers until an MPWQE is refilled. If XSK allocation then returns -ENOMEM, actual_wq_head is not advanced and a later NAPI poll retries the same WQE. mlx5e_free_rx_mpwqe() leaves each released slot marked as releasable. On retry it can therefore call xsk_buff_free() again through stale pointers after the frames have returned to the XSK pool and been reallocated. Set all skip_release_bitmap bits in the common error path of mlx5e_xsk_alloc_rx_mpwqe(). This matches mlx5e_alloc_rx_mpwqe(). A successful allocation already clears the bitmap after replacing every buffer, so retries become idempotent without changing the success path. Fault injection forced three consecutive failures for one selected MPWQE. Both an early allocation failure and a partial 8-of-16-buffer unwind released the original 16 XSK buffers only once. Each error left a full bitmap, the following NAPI retry skipped the release, and a later successful allocation cleared it. A 20-second AF_XDP zero-copy pressure run exercised 1,575,262 buffer allocation failures without invalid descriptors, WQE errors, or kernel warnings.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 4c2a1323680709078736a2886c754004e9fe42e6 ~ f3a52e2ec2788a7f6b64137985c087188a54ad4f -
Linux Linux 6.4 -

II. Public POCs for CVE-2026-99078

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-99078

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-99078 (5)

Same Patch Batch · Linux · 2026-10-23 · 218 CVEs total

CVE-2026-98937 perf/core: Check kernel access when kernel callchains are requested
CVE-2026-98950 flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()
CVE-2026-98949 drm/imagination: Fix reference and vm_bo handling in remap()
CVE-2026-98948 mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()
CVE-2026-98947 vsock: Fix memory leak in vmci_transport_recv_dgram_cb()
CVE-2026-98946 drm/vc4: Disable the V3D interrupt across runtime suspend
CVE-2026-98945 HID: steam: Rearrange teardown sequence
CVE-2026-98944 HID: steam: Refactor registration
CVE-2026-98943 HID: steam: Clean up locking
CVE-2026-98942 sched_ext: Build the cid tables privately and publish them with RCU
CVE-2026-98941 ext4: don't enable large folios on encrypted inodes
CVE-2026-98940 ASoC: qcom: lpass-cpu: use DAI table index for playback constraints
CVE-2026-98939 x86/mm: Drop unnecessary PMD page copy when freeing
CVE-2026-98938 rust: irq: pass RegistrationInner as cookie to request_irq
CVE-2026-98926 drm/amd/display: Remove sink usage from DPMS
CVE-2026-98929 macsec: initialize SecY before registering the netdevice
CVE-2026-98928 KVM: arm64: Derive GUEST_HAS_SVE from the SVE feature bit at EL2
CVE-2026-98927 KVM: arm64: nv: Fix life cycle of the nested_mmus array
CVE-2026-98930 KVM: s390: Fix IRQ injection with SIGP Stop and Store Status
CVE-2026-98925 bpf, sockmap: Fix self-redirect copied_seq double-counting

Showing top 20 of 218 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-99078

No comments yet

Leave a comment