{"api_version":"1","generated_at":"2026-10-27T08:40:08+00:00","cve":"CVE-2026-99078","urls":{"html":"https://cve.report/CVE-2026-99078","api":"https://cve.report/api/cve/CVE-2026-99078.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-99078","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-99078"},"summary":{"title":"net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry\n\nWith AF_XDP on a striding RQ, mlx5e defers releasing XSK buffers until\nan MPWQE is refilled. If XSK allocation then returns -ENOMEM,\nactual_wq_head is not advanced and a later NAPI poll retries the same\nWQE.\n\nmlx5e_free_rx_mpwqe() leaves each released slot marked as releasable. On\nretry it can therefore call xsk_buff_free() again through stale pointers\nafter the frames have returned to the XSK pool and been reallocated.\n\nSet all skip_release_bitmap bits in the common error path of\nmlx5e_xsk_alloc_rx_mpwqe(). This matches mlx5e_alloc_rx_mpwqe(). A\nsuccessful allocation already clears the bitmap after replacing every\nbuffer, so retries become idempotent without changing the success path.\n\nFault injection forced three consecutive failures for one selected MPWQE.\nBoth an early allocation failure and a partial 8-of-16-buffer unwind\nreleased the original 16 XSK buffers only once. Each error left a full\nbitmap, the following NAPI retry skipped the release, and a later\nsuccessful allocation cleared it. A 20-second AF_XDP zero-copy pressure\nrun exercised 1,575,262 buffer allocation failures without invalid\ndescriptors, WQE errors, or kernel warnings.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-10-23 13:17:31","updated_at":"2026-10-24 14:16:54"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"9.8","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"9.8","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/f3a52e2ec2788a7f6b64137985c087188a54ad4f","name":"https://git.kernel.org/stable/c/f3a52e2ec2788a7f6b64137985c087188a54ad4f","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/63811edf512584c946e5e96b100e9e280703bbb5","name":"https://git.kernel.org/stable/c/63811edf512584c946e5e96b100e9e280703bbb5","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/3d73a1164a8c6b4461907a65cb6c022ea4fd39af","name":"https://git.kernel.org/stable/c/3d73a1164a8c6b4461907a65cb6c022ea4fd39af","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/867119b4b588037724b85839d534465f0334d9bd","name":"https://git.kernel.org/stable/c/867119b4b588037724b85839d534465f0334d9bd","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/d215d09606b0fcd18ad1eb532995782a21cea49d","name":"https://git.kernel.org/stable/c/d215d09606b0fcd18ad1eb532995782a21cea49d","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-99078","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99078","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4c2a1323680709078736a2886c754004e9fe42e6 f3a52e2ec2788a7f6b64137985c087188a54ad4f git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4c2a1323680709078736a2886c754004e9fe42e6 d215d09606b0fcd18ad1eb532995782a21cea49d git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4c2a1323680709078736a2886c754004e9fe42e6 867119b4b588037724b85839d534465f0334d9bd git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4c2a1323680709078736a2886c754004e9fe42e6 3d73a1164a8c6b4461907a65cb6c022ea4fd39af git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4c2a1323680709078736a2886c754004e9fe42e6 63811edf512584c946e5e96b100e9e280703bbb5 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.4","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.4 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.160 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.113 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.57 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.11 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/mellanox/mlx5/core/en/xsk/rx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f3a52e2ec2788a7f6b64137985c087188a54ad4f","status":"affected","version":"4c2a1323680709078736a2886c754004e9fe42e6","versionType":"git"},{"lessThan":"d215d09606b0fcd18ad1eb532995782a21cea49d","status":"affected","version":"4c2a1323680709078736a2886c754004e9fe42e6","versionType":"git"},{"lessThan":"867119b4b588037724b85839d534465f0334d9bd","status":"affected","version":"4c2a1323680709078736a2886c754004e9fe42e6","versionType":"git"},{"lessThan":"3d73a1164a8c6b4461907a65cb6c022ea4fd39af","status":"affected","version":"4c2a1323680709078736a2886c754004e9fe42e6","versionType":"git"},{"lessThan":"63811edf512584c946e5e96b100e9e280703bbb5","status":"affected","version":"4c2a1323680709078736a2886c754004e9fe42e6","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/mellanox/mlx5/core/en/xsk/rx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.4"},{"lessThan":"6.4","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.113","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.57","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.160","versionStartIncluding":"6.4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.113","versionStartIncluding":"6.4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.57","versionStartIncluding":"6.4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.11","versionStartIncluding":"6.4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3","versionStartIncluding":"6.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry\n\nWith AF_XDP on a striding RQ, mlx5e defers releasing XSK buffers until\nan MPWQE is refilled. If XSK allocation then returns -ENOMEM,\nactual_wq_head is not advanced and a later NAPI poll retries the same\nWQE.\n\nmlx5e_free_rx_mpwqe() leaves each released slot marked as releasable. On\nretry it can therefore call xsk_buff_free() again through stale pointers\nafter the frames have returned to the XSK pool and been reallocated.\n\nSet all skip_release_bitmap bits in the common error path of\nmlx5e_xsk_alloc_rx_mpwqe(). This matches mlx5e_alloc_rx_mpwqe(). A\nsuccessful allocation already clears the bitmap after replacing every\nbuffer, so retries become idempotent without changing the success path.\n\nFault injection forced three consecutive failures for one selected MPWQE.\nBoth an early allocation failure and a partial 8-of-16-buffer unwind\nreleased the original 16 XSK buffers only once. Each error left a full\nbitmap, the following NAPI retry skipped the release, and a later\nsuccessful allocation cleared it. A 20-second AF_XDP zero-copy pressure\nrun exercised 1,575,262 buffer allocation failures without invalid\ndescriptors, WQE errors, or kernel warnings."}],"metrics":[{"cvssV3_1":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:N - Routable IP packets received by mlx5 consume the AF_XDP striding RQ through mlx5e_completion_event() -> mlx5e_napi_poll() -> mlx5e_poll_rx_cq(), after which mlx5e_napi_xsk_post() -> mlx5e_post_rx_mpwqes() reaches patched mlx5e_xsk_alloc_rx_mpwqe(); packet pressure exhausts the RX/Fill rings and triggers the stale-buffer retry.\nAC:L - A sender can flood the XSK-bound RSS queue until XDP redirect and refill allocation fail, then continue traffic so NAPI retries the unchanged actual_wq_head; no uncontrolled race is needed for mlx5e_free_rx_mpwqe() to release the stale pointer.\nPR:N - The receive path beginning at mlx5e_completion_event() performs no authentication or capability check; xsk_create()'s CAP_NET_RAW requirement applies to victim-side AF_XDP provisioning, while the remote IP sender needs no privileges.\nUI:N - Once an mlx5 AF_XDP zero-copy pool and XDP program are running, packet receipt, mlx5e_napi_xsk_post(), and the refill retries occur automatically without further victim action.\nS:U - The corrupted xsk_buff_pool metadata and mlx5 receive state belong to the host kernel; the bug crosses no VM, IOMMU, or other security-authority boundary.\nC:H - In unaligned-UMEM mode, duplicate live xdp_buff_xsk ownership lets repeated successful __xsk_rcv_zc() calls make xp_release() write kernel pointers past the pool's flexible free_heads[] array; this heap corruption can be leveraged to disclose arbitrary kernel memory.\nI:H - The same xp_release() overflow is an out-of-bounds kernel heap write; subsequent xp_get_xskb() trusts pointers popped from corrupted free_heads[] and initializes through them, supporting arbitrary writes or control-flow corruption.\nA:H - Overflowing free_heads[] or later dereferencing a bogus xskb in xp_get_xskb() can oops or panic; even without a crash, duplicate UMEM ownership can prevent mlx5e_xsk_alloc_rx_mpwqe() from restoring WQEs and stop the bound receive queue."}]}],"providerMetadata":{"dateUpdated":"2026-10-24T14:10:20.145Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/f3a52e2ec2788a7f6b64137985c087188a54ad4f"},{"url":"https://git.kernel.org/stable/c/d215d09606b0fcd18ad1eb532995782a21cea49d"},{"url":"https://git.kernel.org/stable/c/867119b4b588037724b85839d534465f0334d9bd"},{"url":"https://git.kernel.org/stable/c/3d73a1164a8c6b4461907a65cb6c022ea4fd39af"},{"url":"https://git.kernel.org/stable/c/63811edf512584c946e5e96b100e9e280703bbb5"}],"title":"net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-99078","datePublished":"2026-10-23T12:23:25.542Z","dateReserved":"2026-09-25T10:25:14.389Z","dateUpdated":"2026-10-24T14:10:20.145Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-23 13:17:31","lastModifiedDate":"2026-10-24 14:16:54","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"99078","Ordinal":"1","Title":"net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retr","CVE":"CVE-2026-99078","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"99078","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry\n\nWith AF_XDP on a striding RQ, mlx5e defers releasing XSK buffers until\nan MPWQE is refilled. If XSK allocation then returns -ENOMEM,\nactual_wq_head is not advanced and a later NAPI poll retries the same\nWQE.\n\nmlx5e_free_rx_mpwqe() leaves each released slot marked as releasable. On\nretry it can therefore call xsk_buff_free() again through stale pointers\nafter the frames have returned to the XSK pool and been reallocated.\n\nSet all skip_release_bitmap bits in the common error path of\nmlx5e_xsk_alloc_rx_mpwqe(). This matches mlx5e_alloc_rx_mpwqe(). A\nsuccessful allocation already clears the bitmap after replacing every\nbuffer, so retries become idempotent without changing the success path.\n\nFault injection forced three consecutive failures for one selected MPWQE.\nBoth an early allocation failure and a partial 8-of-16-buffer unwind\nreleased the original 16 XSK buffers only once. Each error left a full\nbitmap, the following NAPI retry skipped the release, and a later\nsuccessful allocation cleared it. A 20-second AF_XDP zero-copy pressure\nrun exercised 1,575,262 buffer allocation failures without invalid\ndescriptors, WQE errors, or kernel warnings.","Type":"Description","Title":"net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retr"}]}}}