CVE-2026-99047

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99047", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.388Z", "datePublished": "2026-10-23T12:22:12.104Z", "dateUpdated": "2026-10-23T12:22:12.104Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-23T12:22:12.104Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngve: fix XSK buffer leak when rings are stopped\n\nGVE does not free XSK buffers when resetting ring state as a part of\nstopping queues. This causes all XSK buffers which are posted to the\nNIC to be leaked.\n\nFree XSK buffers attached to an allocated buf_state when stopping rings.\n\nThis issue was hit in production."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/google/gve/gve_rx_dqo.c"], "versions": [{"version": "c1fffc5d66a7147d557736c2341a511e0896d9ff", "lessThan": "506f9de069d07a72b9887ce3edd2fdf32f4953aa", "status": "affected", "versionType": "git"}, {"version": "c1fffc5d66a7147d557736c2341a511e0896d9ff", "lessThan": "7a7e6bbbf0586c1f62f0cc7d9a2877d8a5e5aaf7", "status": "affected", "versionType": "git"}, {"version": "c1fffc5d66a7147d557736c2341a511e0896d9ff", "lessThan": "73670ddb91a4d22e1deb3efd962242de1ec48e90", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/google/gve/gve_rx_dqo.c"], "versions": [{"version": "6.17", "status": "affected"}, {"version": "0", "lessThan": "6.17", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.11", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "7.2.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/506f9de069d07a72b9887ce3edd2fdf32f4953aa"}, {"url": "https://git.kernel.org/stable/c/7a7e6bbbf0586c1f62f0cc7d9a2877d8a5e5aaf7"}, {"url": "https://git.kernel.org/stable/c/73670ddb91a4d22e1deb3efd962242de1ec48e90"}], "title": "gve: fix XSK buffer leak when rings are stopped", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/google/gve/gve_rx_dqo.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "506f9de069d07a72b9887ce3edd2fdf32f4953aa", "status": "affected", "version": "c1fffc5d66a7147d557736c2341a511e0896d9ff", "versionType": "git"}, {"lessThan": "7a7e6bbbf0586c1f62f0cc7d9a2877d8a5e5aaf7", "status": "affected", "version": "c1fffc5d66a7147d557736c2341a511e0896d9ff", "versionType": "git"}, {"lessThan": "73670ddb91a4d22e1deb3efd962242de1ec48e90", "status": "affected", "version": "c1fffc5d66a7147d557736c2341a511e0896d9ff", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/google/gve/gve_rx_dqo.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.17"}, {"lessThan": "6.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngve: fix XSK buffer leak when rings are stopped\n\nGVE does not free XSK buffers when resetting ring state as a part of\nstopping queues. This causes all XSK buffers which are posted to the\nNIC to be leaked.\n\nFree XSK buffers attached to an allocated buf_state when stopping rings.\n\nThis issue was hit in production."}], "id": "CVE-2026-99047", "lastModified": "2026-10-23T13:17:28.183", "metrics": {}, "published": "2026-10-23T13:17:28.183", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/506f9de069d07a72b9887ce3edd2fdf32f4953aa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/73670ddb91a4d22e1deb3efd962242de1ec48e90"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7a7e6bbbf0586c1f62f0cc7d9a2877d8a5e5aaf7"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: gve: fix XSK buffer leak when rings are stopped", "id": "2559761", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559761"}, "csaw": false, "cvss3": {"cvss3_base_score": "2.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ngve: fix XSK buffer leak when rings are stopped\nGVE does not free XSK buffers when resetting ring state as a part of\nstopping queues. This causes all XSK buffers which are posted to the\nNIC to be leaked.\nFree XSK buffers attached to an allocated buf_state when stopping rings.\nThis issue was hit in production.", "A flaw was found in the Google Virtual Ethernet (gve) driver in the Linux kernel. When stopping network queues and resetting the ring state, the driver fails to release eXpress Data Path socket (XSK) buffers posted to the network interface. A local user with network administrative privileges can trigger this issue by reconfiguring or stopping queues, leading to a memory leak and a potential Denial of Service (DoS) due to resource exhaustion."], "name": "CVE-2026-99047", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99047\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99047\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99047.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c1fffc5d66a7147d557736c2341a511e0896d9ff,506f9de069d07a72b9887ce3edd2fdf32f4953aa)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c1fffc5d66a7147d557736c2341a511e0896d9ff,7a7e6bbbf0586c1f62f0cc7d9a2877d8a5e5aaf7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c1fffc5d66a7147d557736c2341a511e0896d9ff,73670ddb91a4d22e1deb3efd962242de1ec48e90)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.17"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.17)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c1fffc5d66a7147d557736c2341a511e0896d9ff,506f9de069d07a72b9887ce3edd2fdf32f4953aa)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c1fffc5d66a7147d557736c2341a511e0896d9ff,7a7e6bbbf0586c1f62f0cc7d9a2877d8a5e5aaf7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c1fffc5d66a7147d557736c2341a511e0896d9ff,73670ddb91a4d22e1deb3efd962242de1ec48e90)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.17"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.17)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-23T16:00:18.684860+00:00", "updated": "2026-10-29T21:00:21.908077+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}