CVE-2026-99078

9.8 CRITICAL

Published 2026-10-23 · Updated 2026-10-24

AI risk analysis

Summary: A flaw in the Linux kernel's mlx5e driver allows reuse of freed XSK buffers on striding RQ when MPWQE refill fails and retries occur, potentially leading to use-after-free or double-free of XSK buffer frames.
Exploitability: Exploitation requires an attacker-controlled workload using AF_XDP with striding RQ that triggers repeated XSK allocation failures (-ENOMEM) to force retry of the same WQE and reuse of stale buffer pointers.
Blast radius: Successful exploitation could allow an unprivileged user with access to AF_XDP to corrupt kernel memory, potentially leading to privilege escalation or system crash.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Apply the fix described in the patch: ensure skip_release_bitmap is fully set in the common error path of mlx5e_xsk_alloc_rx_mpwqe() to prevent double-free on retry; no fixed kernel version is specified in the description, so apply the referenced patch or upgrade to a kernel version that includes commit 1a2b3c4d (hypothetical placeholder — use actual commit ID or vendor advisory if available).

use-after-freedouble-freeaf-xdpkernelmemory-corruption

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry With AF_XDP on a striding RQ, mlx5e defers releasing XSK buffers until an MPWQE is refilled. If XSK allocation then returns -ENOMEM, actual_wq_head is not advanced and a later NAPI poll retries the same WQE. mlx5e_free_rx_mpwqe() leaves each released slot marked as releasable. On retry it can therefore call xsk_buff_free() again through stale pointers after the frames have returned to the XSK pool and been reallocated. Set all skip_release_bitmap bits in the common error path of mlx5e_xsk_alloc_rx_mpwqe(). This matches mlx5e_alloc_rx_mpwqe(). A successful allocation already clears the bitmap after replacing every buffer, so retries become idempotent without changing the success path. Fault injection forced three consecutive failures for one selected MPWQE. Both an early allocation failure and a partial 8-of-16-buffer unwind released the original 16 XSK buffers only once. Each error left a full bitmap, the following NAPI retry skipped the release, and a later successful allocation cleared it. A 20-second AF_XDP zero-copy pressure run exercised 1,575,262 buffer allocation failures without invalid descriptors, WQE errors, or kernel warnings.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.