CVE-2026-99078

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK…

Risk score: 76/100
CVSS: 9.8 v3.1
Exploit chance (30 days): 0.2%
Published: 23 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: A critical vulnerability in the Linux kernel allows an attacker to potentially gain high privileges, read, modify or delete data, and cause a denial of service. This is due to the mlx5e driver not properly releasing XSK buffers on MPWQE refill retry.
Affected: {'products': ['Linux kernel'], 'packages': [], 'versions': []}
Fix: Check the linked advisory for a fix, as none is provided in the record.
Exploitation: No known exploitation

Why it is Amber

CVSS 9.8 critical
Remotely exploitable without logging in
On your watchlist: linux kernel

References

Original description

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry With AF_XDP on a striding RQ, mlx5e defers releasing XSK buffers until an MPWQE is refilled. If XSK allocation then returns -ENOMEM, actual_wq_head is not advanced and a later NAPI poll retries the same WQE. mlx5e_free_rx_mpwqe() leaves each released slot marked as releasable. On retry it can therefore call xsk_buff_free() again through stale pointers after the frames have returned to the XSK pool and been reallocated. Set all skip_release_bitmap bits in the common error path of mlx5e_xsk_alloc_rx_mpwqe(). This matches mlx5e_alloc_rx_mpwqe(). A successful allocation already clears the bitmap after replacing every buffer, so retries become idempotent without changing the success path. Fault injection forced three consecutive failures for one selected MPWQE. Both an early allocation failure and a partial 8-of-16-buffer unwind released the original 16 XSK buffers only once. Each error left a full bitmap, the following NAPI retry skipped the release, and a later successful allocation cleared it. A 20-second AF_XDP zero-copy pressure run exercised 1,575,262 buffer allocation failures without invalid descriptors, WQE errors, or kernel warnings.

Last activity 23 Oct 2026. Patch Forecast updates every hour.