CVE-2026-99079

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99079", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.389Z", "datePublished": "2026-10-23T12:23:26.458Z", "dateUpdated": "2026-10-24T14:10:21.247Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-24T14:10:21.247Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Prevent stale XSK buffer release on refill retry\n\nWhen an XDP redirect to an AF_XDP socket fails because its RX ring is\nfull, the XSK core frees the buffer. During the subsequent batched refill\nof a legacy cyclic RQ, mlx5e also releases the WQE's XSK buffer before\nallocating a replacement. If that refill succeeds only partially, a WQE\nleft without a replacement retains its old buffer pointer.\n\nThe buffer can meanwhile be allocated to another WQE. A later refill\nretry can then free the live buffer through the stale pointer and publish\nthe same UMEM frame twice.\n\nMark the WQE as released immediately after the driver-side free. The flag\nis already cleared when a replacement buffer is assigned, so refill\nretries no longer release stale pointers.\n\nThe failure is silent and produces no kernel warning or splat. A\nstandalone legacy cyclic-RQ zero-copy libxsk reproducer, using 64-byte UDP\ntraffic offered at 12 Mpps, detected it: stock stopped after 2,854,914\npackets in 4.094 seconds, with 4,542 xdp_rx_ring_full events and 64\nownership/double-publication errors. With this change it processed\n356,904,225 packets in 30 seconds despite 571,405 xdp_rx_ring_full events,\nwith no ownership or data errors."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - UDP datagrams reaching mlx5 drive mlx5e_completion_event() -> mlx5e_napi_poll() -> mlx5e_poll_rx_cq()/XDP redirect, then mlx5e_napi_xsk_post() -> mlx5e_post_rx_wqes() -> patched mlx5e_xsk_free_rx_wqe(); sustained routable traffic fills the XSK RX ring and triggers stale release.\nAC:L - A sender can sustain small-packet traffic until __xsk_rcv_zc() reports RX-ring-full and mlx5e_xsk_alloc_rx_wqes_batched() refills only part of the missing WQEs; retries are deterministic and require no uncontrolled race or memory layout.\nPR:N - The NIC-CQE/NAPI receive path contains no capability or authentication check; xsk_create()'s CAP_NET_RAW check applies to victim-side AF_XDP provisioning, while the remote UDP sender needs no privileges.\nUI:N - Once the zero-copy XSK pool and XDP redirect are active, xsk_rcv_zc() failure, mlx5e_napi_xsk_post(), and refill retries occur automatically as packets arrive, without further victim action.\nS:U - mlx5e_xsk_free_rx_wqe() corrupts the host kernel's xsk_buff_pool and mlx5 receive state without crossing a VM, IOMMU, or other security-authority boundary.\nC:H - Duplicate xdp_buff_xsk ownership lets repeated successful __xsk_rcv_zc() calls invoke unbounded xp_release(); in unaligned-UMEM mode, free_heads_cnt can write kernel pointers past the flexible free_heads[] array, yielding heap corruption exploitable for arbitrary disclosure.\nI:H - The duplicate WQEs can make xp_release() write beyond free_heads[], while xp_get_xskb() later trusts pointers popped through the corrupted count; this supplies out-of-bounds and corrupted-pointer write primitives capable of control-flow hijacking.\nA:H - The free_heads[] overflow or a bogus xskb consumed by xp_get_xskb() can oops or panic; additionally, the dma_dev_need_sync refill path can store NULL on allocation failure and have the stale retry pass it to xsk_buff_free()."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/en_rx.c"], "versions": [{"version": "3f93f82988bc6b4104314bf9aa485d47fbb7e241", "lessThan": "32bbb870078d467479965c21bbc4960c57eea208", "status": "affected", "versionType": "git"}, {"version": "3f93f82988bc6b4104314bf9aa485d47fbb7e241", "lessThan": "34d1db2b18e1c1d189e34dd51923e031815f88e3", "status": "affected", "versionType": "git"}, {"version": "3f93f82988bc6b4104314bf9aa485d47fbb7e241", "lessThan": "639522e5056cade578a324acfa993ec6c9f7f5dc", "status": "affected", "versionType": "git"}, {"version": "3f93f82988bc6b4104314bf9aa485d47fbb7e241", "lessThan": "655f47477054d19de3b138840be229a1a4490d0c", "status": "affected", "versionType": "git"}, {"version": "3f93f82988bc6b4104314bf9aa485d47fbb7e241", "lessThan": "e01620844c5c88b6fcf819d171df8e3976a0e76f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/en_rx.c"], "versions": [{"version": "6.4", "status": "affected"}, {"version": "0", "lessThan": "6.4", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.11", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "7.2.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/32bbb870078d467479965c21bbc4960c57eea208"}, {"url": "https://git.kernel.org/stable/c/34d1db2b18e1c1d189e34dd51923e031815f88e3"}, {"url": "https://git.kernel.org/stable/c/639522e5056cade578a324acfa993ec6c9f7f5dc"}, {"url": "https://git.kernel.org/stable/c/655f47477054d19de3b138840be229a1a4490d0c"}, {"url": "https://git.kernel.org/stable/c/e01620844c5c88b6fcf819d171df8e3976a0e76f"}], "title": "net/mlx5e: Prevent stale XSK buffer release on refill retry", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/en_rx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "32bbb870078d467479965c21bbc4960c57eea208", "status": "affected", "version": "3f93f82988bc6b4104314bf9aa485d47fbb7e241", "versionType": "git"}, {"lessThan": "34d1db2b18e1c1d189e34dd51923e031815f88e3", "status": "affected", "version": "3f93f82988bc6b4104314bf9aa485d47fbb7e241", "versionType": "git"}, {"lessThan": "639522e5056cade578a324acfa993ec6c9f7f5dc", "status": "affected", "version": "3f93f82988bc6b4104314bf9aa485d47fbb7e241", "versionType": "git"}, {"lessThan": "655f47477054d19de3b138840be229a1a4490d0c", "status": "affected", "version": "3f93f82988bc6b4104314bf9aa485d47fbb7e241", "versionType": "git"}, {"lessThan": "e01620844c5c88b6fcf819d171df8e3976a0e76f", "status": "affected", "version": "3f93f82988bc6b4104314bf9aa485d47fbb7e241", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/en_rx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.4"}, {"lessThan": "6.4", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Prevent stale XSK buffer release on refill retry\n\nWhen an XDP redirect to an AF_XDP socket fails because its RX ring is\nfull, the XSK core frees the buffer. During the subsequent batched refill\nof a legacy cyclic RQ, mlx5e also releases the WQE's XSK buffer before\nallocating a replacement. If that refill succeeds only partially, a WQE\nleft without a replacement retains its old buffer pointer.\n\nThe buffer can meanwhile be allocated to another WQE. A later refill\nretry can then free the live buffer through the stale pointer and publish\nthe same UMEM frame twice.\n\nMark the WQE as released immediately after the driver-side free. The flag\nis already cleared when a replacement buffer is assigned, so refill\nretries no longer release stale pointers.\n\nThe failure is silent and produces no kernel warning or splat. A\nstandalone legacy cyclic-RQ zero-copy libxsk reproducer, using 64-byte UDP\ntraffic offered at 12 Mpps, detected it: stock stopped after 2,854,914\npackets in 4.094 seconds, with 4,542 xdp_rx_ring_full events and 64\nownership/double-publication errors. With this change it processed\n356,904,225 packets in 30 seconds despite 571,405 xdp_rx_ring_full events,\nwith no ownership or data errors."}], "id": "CVE-2026-99079", "lastModified": "2026-10-24T14:16:54.940", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-10-23T13:17:32.040", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/32bbb870078d467479965c21bbc4960c57eea208"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/34d1db2b18e1c1d189e34dd51923e031815f88e3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/639522e5056cade578a324acfa993ec6c9f7f5dc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/655f47477054d19de3b138840be229a1a4490d0c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e01620844c5c88b6fcf819d171df8e3976a0e76f"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net/mlx5e: Prevent stale XSK buffer release on refill retry", "id": "2559735", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559735"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-1341", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet/mlx5e: Prevent stale XSK buffer release on refill retry\nWhen an XDP redirect to an AF_XDP socket fails because its RX ring is\nfull, the XSK core frees the buffer. During the subsequent batched refill\nof a legacy cyclic RQ, mlx5e also releases the WQE's XSK buffer before\nallocating a replacement. If that refill succeeds only partially, a WQE\nleft without a replacement retains its old buffer pointer.\nThe buffer can meanwhile be allocated to another WQE. A later refill\nretry can then free the live buffer through the stale pointer and publish\nthe same UMEM frame twice.\nMark the WQE as released immediately after the driver-side free. The flag\nis already cleared when a replacement buffer is assigned, so refill\nretries no longer release stale pointers.\nThe failure is silent and produces no kernel warning or splat. A\nstandalone legacy cyclic-RQ zero-copy libxsk reproducer, using 64-byte UDP\ntraffic offered at 12 Mpps, detected it: stock stopped after 2,854,914\npackets in 4.094 seconds, with 4,542 xdp_rx_ring_full events and 64\nownership/double-publication errors. With this change it processed\n356,904,225 packets in 30 seconds despite 571,405 xdp_rx_ring_full events,\nwith no ownership or data errors.", "A flaw was found in the Linux kernel's Mellanox network driver (mlx5e). When network traffic redirected to an AF_XDP (eXpress Data Path) socket encounters a full receive ring and buffer refills only partially succeed, the driver retains a stale buffer reference. A remote attacker could exploit this condition by sending high volumes of network traffic, causing the driver to prematurely free active memory buffers during refill retries. This issue can lead to memory corruption or a Denial of Service (DoS)."], "name": "CVE-2026-99079", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99079\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99079\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99079.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3f93f82988bc6b4104314bf9aa485d47fbb7e241,32bbb870078d467479965c21bbc4960c57eea208)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3f93f82988bc6b4104314bf9aa485d47fbb7e241,34d1db2b18e1c1d189e34dd51923e031815f88e3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3f93f82988bc6b4104314bf9aa485d47fbb7e241,639522e5056cade578a324acfa993ec6c9f7f5dc)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3f93f82988bc6b4104314bf9aa485d47fbb7e241,655f47477054d19de3b138840be229a1a4490d0c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3f93f82988bc6b4104314bf9aa485d47fbb7e241,e01620844c5c88b6fcf819d171df8e3976a0e76f)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.4"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.4)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.160,6.7.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.57,6.19.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3f93f82988bc6b4104314bf9aa485d47fbb7e241,32bbb870078d467479965c21bbc4960c57eea208)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3f93f82988bc6b4104314bf9aa485d47fbb7e241,34d1db2b18e1c1d189e34dd51923e031815f88e3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3f93f82988bc6b4104314bf9aa485d47fbb7e241,639522e5056cade578a324acfa993ec6c9f7f5dc)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3f93f82988bc6b4104314bf9aa485d47fbb7e241,655f47477054d19de3b138840be229a1a4490d0c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3f93f82988bc6b4104314bf9aa485d47fbb7e241,e01620844c5c88b6fcf819d171df8e3976a0e76f)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.4"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.4)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.160,6.7.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.57,6.19.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-23T15:45:16.727777+00:00", "updated": "2026-10-27T09:45:06.903398+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}