CVE-2026-68135 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
net: hip04: fix RX buffer leak on build_skb failure
When build_skb() fails in hip04_rx_poll(), the driver jumps to the refill path without releasing the current RX buffer and its DMA mapping. Installing a replacement buffer then overwrites the slot references and leaks both resources.
Keep the current slot intact and return budget so NAPI retries the same buffer. Also free a newly allocated RX fragment when dma_map_single() fails.
This issue was found by an in-house static analysis tool.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability exists within the linux kernel's hip04 network driver implementation where a memory resource leak occurs during packet reception handling. This flaw manifests when the build_skb() function fails during the hip04_rx_poll() processing loop, creating a scenario where critical network buffer resources remain unreleased. The issue represents a classic memory management oversight that can lead to progressive resource exhaustion and system instability.
The technical root cause involves improper error handling within the network driver's receive path where the code flow does not properly account for failure conditions during buffer allocation. Specifically when build_skb() returns an error, the driver attempts to refill the receive ring but fails to release the currently occupied RX buffer slot along with its associated DMA mapping resources. This creates a resource leak scenario where both kernel memory and DMA mappings remain allocated without proper cleanup.
The operational impact of this vulnerability extends beyond simple memory consumption as it affects system stability and network performance under sustained load conditions. Network drivers that maintain fixed buffer pools can experience progressive degradation as leaked buffers accumulate, potentially leading to complete loss of network functionality. The issue becomes particularly critical in high-throughput environments where the driver processes numerous packets and the leak compounds over time.
The fix implements proper resource management by preserving the current slot reference when build_skb() fails, allowing NAPI subsystem to retry processing the same buffer rather than advancing to refill operations. Additionally, the solution addresses a secondary failure case where dma_map_single() can fail during fragment allocation, ensuring newly allocated RX fragments are properly freed when mapping operations fail. This approach aligns with standard network driver development practices and follows the principle of resource cleanup on error paths.
This vulnerability type maps to CWE-401: Improper Release of Memory Before Removing Last Reference and CWE-775: Missing Release of Resource after Effective Use, both of which are fundamental memory management issues in systems programming. From an ATT&CK perspective, this represents a potential denial of service vector through resource exhaustion that could be leveraged by adversaries to disrupt network services or consume system resources.
The static analysis tool that discovered this issue demonstrates the effectiveness of automated code review techniques in identifying subtle memory management flaws within kernel subsystems. Such tools play a crucial role in maintaining kernel security and stability as they can catch edge case scenarios that manual code reviews might miss during routine development cycles, particularly in complex networking drivers where error paths are often under-tested.
This fix exemplifies proper defensive programming practices in kernel space where every resource allocation must have corresponding cleanup logic regardless of execution path taken. The solution maintains the driver's operational integrity while preventing resource leaks that could accumulate over time and impact system reliability. The approach also ensures proper interaction with NAPI subsystem which manages interrupt processing and buffer consumption patterns within the network stack.
The resolution addresses both immediate resource leak conditions and broader error handling patterns within the driver, making it resilient to various failure scenarios during packet reception. This type of vulnerability is particularly concerning in embedded systems or virtualized environments where memory resources are constrained and resource leaks can quickly escalate into system-wide failures. The fix maintains backward compatibility while strengthening the driver's robustness against edge case error conditions that could be triggered by malformed network traffic or adversarial input patterns.