CVE-2026-99079

9.8 CRITICAL

Published 2026-10-23 · Updated 2026-10-24

AI risk analysis

Summary: A race condition in the Linux kernel's mlx5e network driver can cause an XSK buffer to be freed twice when an XDP redirect fails and a subsequent refill retry reuses a stale pointer, leading to use-after-free and potential memory corruption.
Exploitability: Exploitation requires high packet rates (e.g., ~12 Mpps) on an affected system with AF_XDP sockets and XDP redirect configured, and relies on the specific timing of ring-full failures and partial refill retries; it is not trivial to trigger reliably.
Blast radius: Successful exploitation could allow an unprivileged local user or compromised workload to corrupt kernel memory, potentially leading to privilege escalation or system crash.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Apply the patch referenced in the commit message for CVE-2026-99079, which marks WQEs as released immediately after driver-side free to prevent stale buffer release on retry; no fixed kernel version is named in the description, so apply the specific patch or upgrade to a kernel version that includes it.

use-after-freekernelaf-xdpxdpracing-condition

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on refill retry When an XDP redirect to an AF_XDP socket fails because its RX ring is full, the XSK core frees the buffer. During the subsequent batched refill of a legacy cyclic RQ, mlx5e also releases the WQE's XSK buffer before allocating a replacement. If that refill succeeds only partially, a WQE left without a replacement retains its old buffer pointer. The buffer can meanwhile be allocated to another WQE. A later refill retry can then free the live buffer through the stale pointer and publish the same UMEM frame twice. Mark the WQE as released immediately after the driver-side free. The flag is already cleared when a replacement buffer is assigned, so refill retries no longer release stale pointers. The failure is silent and produces no kernel warning or splat. A standalone legacy cyclic-RQ zero-copy libxsk reproducer, using 64-byte UDP traffic offered at 12 Mpps, detected it: stock stopped after 2,854,914 packets in 4.094 seconds, with 4,542 xdp_rx_ring_full events and 64 ownership/double-publication errors. With this change it processed 356,904,225 packets in 30 seconds despite 571,405 xdp_rx_ring_full events, with no ownership or data errors.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.