Linux kernel mlx5e に解放の誤り、修正版あり
Summary
Linux kernel の mlx5e ドライバーに、メモリ確保に失敗した後の再試行で同じバッファを二重に解放してしまう欠陥が見つかりました。影響が出るのは、mlx5 系のネットワークカードで AF_XDP のゼロコピー受信を使っている環境です。該当する場合は、修正版のカーネルまたはディストリビューションの更新パッケージを計画的に適用してください。
AI summary
Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.
Linux kernel の mlx5e ドライバーに、メモリ確保に失敗した後の再試行で同じバッファを二重に解放してしまう欠陥が見つかりました。影響が出るのは、mlx5 系のネットワークカードで AF_XDP のゼロコピー受信を使っている環境です。該当する場合は、修正版のカーネルまたはディストリビューションの更新パッケージを計画的に適用してください。
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | — | — |
| Linux | Kernel |
≥ 6.4.0, < 6.6.160 ≥ 6.7.0, < 6.12.113 ≥ 6.13.0, < 6.18.57 ≥ 6.19.0, < 7.2.11 |
6.6.160 6.12.113 6.18.57 7.2.11 |
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-99078 linux Fixed in: 6.12.113-1
Original description The description as published by the source.
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
With AF_XDP on a striding RQ, mlx5e defers releasing XSK buffers until
an MPWQE is refilled. If XSK allocation then returns -ENOMEM,
actual_wq_head is not advanced and a later NAPI poll retries the same
WQE.
mlx5e_free_rx_mpwqe() leaves each released slot marked as releasable. On
retry it can therefore call xsk_buff_free() again through stale pointers
after the frames have returned to the XSK pool and been reallocated.
Set all skip_release_bitmap bits in the common error path of
mlx5e_xsk_alloc_rx_mpwqe(). This matches mlx5e_alloc_rx_mpwqe(). A
successful allocation already clears the bitmap after replacing every
buffer, so retries become idempotent without changing the success path.
Fault injection forced three consecutive failures for one selected MPWQE.
Both an early allocation failure and a partial 8-of-16-buffer unwind
released the original 16 XSK buffers only once. Each error left a full
bitmap, the following NAPI retry skipped the release, and a later
successful allocation cleared it. A 20-second AF_XDP zero-copy pressure
run exercised 1,575,262 buffer allocation failures without invalid
descriptors, WQE errors, or kernel warnings.
Source: Linux kernel CVE announcements NVD GitHub Advisory
References
- advisory nvd.nist.gov
- advisory github.com
- LINUX-CVE-ANNOUNCE CVE-2026-99078: net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
- package git.kernel.org
- web git.kernel.org
- web git.kernel.org
- web git.kernel.org
- web git.kernel.org
- web git.kernel.org
- web github.com