{"id":"CVE-2026-99079","published":"2026-10-23T13:17:32Z","modified":"2026-10-24T14:16:54Z","title":"In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on…","vendor":"Linux","product":"Linux","tier":"core","eol":null,"description":{"text":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Prevent stale XSK buffer release on refill retry\n\nWhen an XDP redirect to an AF_XDP socket fails because its RX ring is\nfull, the XSK core frees the buffer. During the subsequent batched refill\nof a legacy cyclic RQ, mlx5e also releases the WQE's XSK buffer before\nallocating a replacement. If that refill succeeds only partially, a WQE\nleft without a replacement retains its old buffer pointer.\n\nThe buffer can meanwhile be allocated to another WQE. A later refill\nretry can then free the live buffer through the stale pointer and publish\nthe same UMEM frame twice.\n\nMark the WQE as released immediately after the driver-side free. The flag\nis already cleared when a replacement buffer is assigned, so refill\nretries no longer release stale pointers.\n\nThe failure is silent and produces no kernel warning or splat. A\nstandalone legacy cyclic-RQ zero-copy libxsk reproducer, using 64-byte UDP\ntraffic offered at 12 Mpps, detected it: stock stopped after 2,854,914\npackets in 4.094 seconds, with 4,542 xdp_rx_ring_full events and 64\nownership/double-publication errors. With this change it processed\n356,904,225 packets in 30 seconds despite 571,405 xdp_rx_ring_full events,\nwith no ownership or data errors.","provenance":"source","from":"NVD"},"summary":{"text":"The Linux kernel's mlx5e network driver (net/mlx5e, the legacy cyclic receive queue path used with AF_XDP zero-copy sockets) can release an XSK buffer through a stale pointer during a refill retry, causing the same UMEM frame to be published twice.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:24:36Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.00455,"percentile":0.39531,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":6,"pulses":[{"name":"Known_Cve | Oct 31, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6ae4af0017a739f65534f550","created":"2026-10-30"},{"name":"Known_Cve | Oct 30, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6ae35d8e6ee9e838fd042498","created":"2026-10-29"},{"name":"Known_Cve | Oct 29, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6ae20c290cecfbc79bd84822","created":"2026-10-28"},{"name":"Known_Cve | Oct 28, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6ae0ba8e2d29f6aa1bfe6f11","created":"2026-10-27"},{"name":"Known_Cve | Oct 27, 2026 | Part 3/3","url":"https://otx.alienvault.com/pulse/6adf68ca1522e5424ef6b0c7","created":"2026-10-26"},{"name":"Known_Cve | Oct 24, 2026 | Part 3/3","url":"https://otx.alienvault.com/pulse/6adb7421f0eaee440740fbf3","created":"2026-10-23"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://git.kernel.org/stable/c/32bbb870078d467479965c21bbc4960c57eea208","tags":[]},{"url":"https://git.kernel.org/stable/c/34d1db2b18e1c1d189e34dd51923e031815f88e3","tags":[]},{"url":"https://git.kernel.org/stable/c/639522e5056cade578a324acfa993ec6c9f7f5dc","tags":[]},{"url":"https://git.kernel.org/stable/c/655f47477054d19de3b138840be229a1a4490d0c","tags":[]},{"url":"https://git.kernel.org/stable/c/e01620844c5c88b6fcf819d171df8e3976a0e76f","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-108745","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-108745","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-23","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99079","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":16.7,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":7.91,"detail":"percentile 0.3953"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":1.92,"detail":"6 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}