{"id":"CVE-2026-99078","published":"2026-10-23T13:17:31Z","modified":"2026-10-24T14:16:54Z","title":"In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on…","vendor":"Linux","product":"Linux","tier":"core","eol":null,"description":{"text":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry\n\nWith AF_XDP on a striding RQ, mlx5e defers releasing XSK buffers until\nan MPWQE is refilled. If XSK allocation then returns -ENOMEM,\nactual_wq_head is not advanced and a later NAPI poll retries the same\nWQE.\n\nmlx5e_free_rx_mpwqe() leaves each released slot marked as releasable. On\nretry it can therefore call xsk_buff_free() again through stale pointers\nafter the frames have returned to the XSK pool and been reallocated.\n\nSet all skip_release_bitmap bits in the common error path of\nmlx5e_xsk_alloc_rx_mpwqe(). This matches mlx5e_alloc_rx_mpwqe(). A\nsuccessful allocation already clears the bitmap after replacing every\nbuffer, so retries become idempotent without changing the success path.\n\nFault injection forced three consecutive failures for one selected MPWQE.\nBoth an early allocation failure and a partial 8-of-16-buffer unwind\nreleased the original 16 XSK buffers only once. Each error left a full\nbitmap, the following NAPI retry skipped the release, and a later\nsuccessful allocation cleared it. A 20-second AF_XDP zero-copy pressure\nrun exercised 1,575,262 buffer allocation failures without invalid\ndescriptors, WQE errors, or kernel warnings.","provenance":"source","from":"NVD"},"summary":{"text":"The Linux kernel's mlx5e network driver, in its AF_XDP zero-copy receive path on striding RQs, can release XSK buffers a second time through stale pointers when an MPWQE refill is retried after an allocation failure.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:24:35Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.00455,"percentile":0.39531,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":6,"pulses":[{"name":"Known_Cve | Oct 31, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6ae4af0017a739f65534f550","created":"2026-10-30"},{"name":"Known_Cve | Oct 30, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6ae35d8e6ee9e838fd042498","created":"2026-10-29"},{"name":"Known_Cve | Oct 29, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6ae20c290cecfbc79bd84822","created":"2026-10-28"},{"name":"Known_Cve | Oct 28, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6ae0ba8e2d29f6aa1bfe6f11","created":"2026-10-27"},{"name":"Known_Cve | Oct 27, 2026 | Part 3/3","url":"https://otx.alienvault.com/pulse/6adf68ca1522e5424ef6b0c7","created":"2026-10-26"},{"name":"Known_Cve | Oct 24, 2026 | Part 3/3","url":"https://otx.alienvault.com/pulse/6adb7421f0eaee440740fbf3","created":"2026-10-23"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://git.kernel.org/stable/c/3d73a1164a8c6b4461907a65cb6c022ea4fd39af","tags":[]},{"url":"https://git.kernel.org/stable/c/63811edf512584c946e5e96b100e9e280703bbb5","tags":[]},{"url":"https://git.kernel.org/stable/c/867119b4b588037724b85839d534465f0334d9bd","tags":[]},{"url":"https://git.kernel.org/stable/c/d215d09606b0fcd18ad1eb532995782a21cea49d","tags":[]},{"url":"https://git.kernel.org/stable/c/f3a52e2ec2788a7f6b64137985c087188a54ad4f","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-108744","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-108744","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-23","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99078","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":16.7,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":7.91,"detail":"percentile 0.3953"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":1.92,"detail":"6 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}