Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-99079— net/mlx5e: Prevent stale XSK buffer release on refill retry

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： net/mlx5e：防止在 refill 重试时释放过期的 XSK 缓冲区 当 XDP 重定向到 AF_XDP 套接字因接收（RX）环形缓冲区已满而失败时，XSK 核心会释放该缓冲区。随后，在对传统循环接收队列（legacy cyclic RQ）执行批量 refill 操作时，mlx5e 驱动会在分配新缓冲区之前，先释放工作队列项（WQE）关联的 XSK 缓冲区。如果该 refill 操作仅部分成功，某些未被分配新缓冲区的 WQE 将保留其旧的缓冲区指针。 与此同时，该

AI Predicted 5.5 Difficulty: Moderate

Possible ATT&CK Techniques 1 AI

T1069.006

Affected Version Matrix 12

VendorProduct Version RangeStatus
Linux Linux 3f93f82988bc6b4104314bf9aa485d47fbb7e241< 32bbb870078d467479965c21bbc4960c57eea208 affected
3f93f82988bc6b4104314bf9aa485d47fbb7e241< 34d1db2b18e1c1d189e34dd51923e031815f88e3 affected
3f93f82988bc6b4104314bf9aa485d47fbb7e241< 639522e5056cade578a324acfa993ec6c9f7f5dc affected
3f93f82988bc6b4104314bf9aa485d47fbb7e241< 655f47477054d19de3b138840be229a1a4490d0c affected
3f93f82988bc6b4104314bf9aa485d47fbb7e241< e01620844c5c88b6fcf819d171df8e3976a0e76f affected
6.4 affected
< 6.4 unaffected
6.6.160≤ 6.6.* unaffected
… +4 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-99079

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
net/mlx5e: Prevent stale XSK buffer release on refill retry
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on refill retry When an XDP redirect to an AF_XDP socket fails because its RX ring is full, the XSK core frees the buffer. During the subsequent batched refill of a legacy cyclic RQ, mlx5e also releases the WQE's XSK buffer before allocating a replacement. If that refill succeeds only partially, a WQE left without a replacement retains its old buffer pointer. The buffer can meanwhile be allocated to another WQE. A later refill retry can then free the live buffer through the stale pointer and publish the same UMEM frame twice. Mark the WQE as released immediately after the driver-side free. The flag is already cleared when a replacement buffer is assigned, so refill retries no longer release stale pointers. The failure is silent and produces no kernel warning or splat. A standalone legacy cyclic-RQ zero-copy libxsk reproducer, using 64-byte UDP traffic offered at 12 Mpps, detected it: stock stopped after 2,854,914 packets in 4.094 seconds, with 4,542 xdp_rx_ring_full events and 64 ownership/double-publication errors. With this change it processed 356,904,225 packets in 30 seconds despite 571,405 xdp_rx_ring_full events, with no ownership or data errors.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 3f93f82988bc6b4104314bf9aa485d47fbb7e241 ~ 32bbb870078d467479965c21bbc4960c57eea208 -
Linux Linux 6.4 -

II. Public POCs for CVE-2026-99079

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-99079

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-99079 (2)

Same Patch Batch · Linux · 2026-10-23 · 218 CVEs total

CVE-2026-98937 perf/core: Check kernel access when kernel callchains are requested
CVE-2026-98950 flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()
CVE-2026-98949 drm/imagination: Fix reference and vm_bo handling in remap()
CVE-2026-98948 mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()
CVE-2026-98947 vsock: Fix memory leak in vmci_transport_recv_dgram_cb()
CVE-2026-98946 drm/vc4: Disable the V3D interrupt across runtime suspend
CVE-2026-98945 HID: steam: Rearrange teardown sequence
CVE-2026-98944 HID: steam: Refactor registration
CVE-2026-98943 HID: steam: Clean up locking
CVE-2026-98942 sched_ext: Build the cid tables privately and publish them with RCU
CVE-2026-98941 ext4: don't enable large folios on encrypted inodes
CVE-2026-98940 ASoC: qcom: lpass-cpu: use DAI table index for playback constraints
CVE-2026-98939 x86/mm: Drop unnecessary PMD page copy when freeing
CVE-2026-98938 rust: irq: pass RegistrationInner as cookie to request_irq
CVE-2026-98926 drm/amd/display: Remove sink usage from DPMS
CVE-2026-98929 macsec: initialize SecY before registering the netdevice
CVE-2026-98928 KVM: arm64: Derive GUEST_HAS_SVE from the SVE feature bit at EL2
CVE-2026-98927 KVM: arm64: nv: Fix life cycle of the nested_mmus array
CVE-2026-98930 KVM: s390: Fix IRQ injection with SIGP Stop and Store Status
CVE-2026-98925 bpf, sockmap: Fix self-redirect copied_seq double-counting

Showing top 20 of 218 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-99079

No comments yet

Leave a comment