{"id":"CVE-2026-99079","published":"2026-10-23T13:17:32.040","lastModified":"2026-10-24T14:16:54.940","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Prevent stale XSK buffer release on refill retry\n\nWhen an XDP redirect to an AF_XDP socket fails because its RX ring is\nfull, the XSK core frees the buffer. During the subsequent batched refill\nof a legacy cyclic RQ, mlx5e also releases the WQE's XSK buffer before\nallocating a replacement. If that refill succeeds only partially, a WQE\nleft without a replacement retains its old buffer pointer.\n\nThe buffer can meanwhile be allocated to another WQE. A later refill\nretry can then free the live buffer through the stale pointer and publish\nthe same UMEM frame twice.\n\nMark the WQE as released immediately after the driver-side free. The flag\nis already cleared when a replacement buffer is assigned, so refill\nretries no longer release stale pointers.\n\nThe failure is silent and produces no kernel warning or splat. A\nstandalone legacy cyclic-RQ zero-copy libxsk reproducer, using 64-byte UDP\ntraffic offered at 12 Mpps, detected it: stock stopped after 2,854,914\npackets in 4.094 seconds, with 4,542 xdp_rx_ring_full events and 64\nownership/double-publication errors. With this change it processed\n356,904,225 packets in 30 seconds despite 571,405 xdp_rx_ring_full events,\nwith no ownership or data errors.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/32bbb870078d467479965c21bbc4960c57eea208","tags":[]},{"url":"https://git.kernel.org/stable/c/34d1db2b18e1c1d189e34dd51923e031815f88e3","tags":[]},{"url":"https://git.kernel.org/stable/c/639522e5056cade578a324acfa993ec6c9f7f5dc","tags":[]},{"url":"https://git.kernel.org/stable/c/655f47477054d19de3b138840be229a1a4490d0c","tags":[]},{"url":"https://git.kernel.org/stable/c/e01620844c5c88b6fcf819d171df8e3976a0e76f","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A race condition in the Linux kernel's mlx5e network driver can cause an XSK buffer to be freed twice when an XDP redirect fails and a subsequent refill retry reuses a stale pointer, leading to use-after-free and potential memory corruption.","exploitability":"Exploitation requires high packet rates (e.g., ~12 Mpps) on an affected system with AF_XDP sockets and XDP redirect configured, and relies on the specific timing of ring-full failures and partial refill retries; it is not trivial to trigger reliably.","blast_radius":"Successful exploitation could allow an unprivileged local user or compromised workload to corrupt kernel memory, potentially leading to privilege escalation or system crash.","remediation":"Apply the patch referenced in the commit message for CVE-2026-99079, which marks WQEs as released immediately after driver-side free to prevent stale buffer release on retry; no fixed kernel version is named in the description, so apply the specific patch or upgrade to a kernel version that includes it.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["use-after-free","kernel","af-xdp","xdp","racing-condition"],"model":"garnet-coder","analyzedAt":"2026-10-25T08:44:25.517Z"}}