CVE-2026-72056 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
net: ena: clean up XDP TX queues when regular TX setup fails
create_queues_with_size_backoff() creates XDP TX queues before setting up the regular TX path. If the subsequent allocation or creation of regular TX queues fails, the error handling paths omit the teardown of the XDP TX queues, leading to a resource leak.
Fix this by explicitly destroying the XDP TX queue subset at the two missing failure points.
The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1-rc7.
An x86_64 allyesconfig build showed no new warnings. As we do not have an ENA device to test with, no runtime testing was able to be performed.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability identified in the Linux kernel's ena network driver represents a critical resource management flaw that can lead to memory leaks and potential system instability. This issue specifically affects the network interface controller driver for Amazon Elastic Network Adapter devices, which are commonly used in cloud computing environments. The problem manifests during the initialization sequence where the driver attempts to set up both XDP (eXpress Data Path) TX queues and regular TX queues simultaneously. The XDP TX queues are created first as part of the driver's setup process, but when subsequent allocation or creation of regular TX queues fails due to resource constraints or other initialization errors, the error handling logic fails to properly clean up the already allocated XDP TX queues.
This memory leak occurs because the create_queues_with_size_backoff() function implements a flawed error recovery mechanism that does not account for cleanup of partially initialized resources. The technical implementation flaw stems from inadequate resource management in the driver's initialization path, where the code paths for handling failures do not consistently execute the necessary teardown procedures for XDP TX queues. This creates a situation where allocated kernel memory remains unreleased even after the driver initialization has failed, leading to gradual resource exhaustion over time.
The operational impact of this vulnerability extends beyond simple memory leaks to potentially affect system stability and performance in production environments. When multiple network interface cards are present or when the driver experiences initialization failures due to resource contention, the accumulation of leaked XDP TX queue resources can lead to increased kernel memory pressure and reduced system responsiveness. This is particularly concerning in high-throughput server environments where ENA devices are commonly deployed and where resource management efficiency is critical for maintaining service levels.
From a cybersecurity perspective, this vulnerability aligns with CWE-404, which addresses improper resource cleanup or release, and represents a potential attack vector for resource exhaustion attacks. The flaw could be exploited by malicious actors to gradually consume system resources through repeated driver initialization attempts, leading to denial of service conditions. Additionally, the vulnerability demonstrates characteristics consistent with ATT&CK technique T1499.001, which involves resource exhaustion via manipulation of system resources, as the improper cleanup creates persistent resource leaks that can be leveraged for sustained impact.
The mitigation strategy requires explicit cleanup of XDP TX queues at the two identified failure points within the error handling code paths. This fix ensures that regardless of whether regular TX queue setup succeeds or fails, any previously allocated XDP TX queues are properly destroyed and their resources released back to the kernel memory management system. The solution follows established best practices for resource management in kernel space where all allocated resources must be accounted for and properly cleaned up during error conditions. This approach aligns with Linux kernel development guidelines that emphasize robust error handling and proper resource lifecycle management.
The vulnerability was discovered through automated analysis tools designed to detect kernel memory management issues, highlighting the importance of systematic testing approaches for identifying subtle resource management bugs in complex kernel subsystems. While no runtime testing was performed due to lack of ENA hardware availability, the fix maintains compatibility with existing kernel configurations and builds without introducing new warnings or regressions. The resolution demonstrates the critical need for comprehensive error handling in kernel drivers where partial initialization failures must be properly managed to prevent resource leaks that could compromise system stability over extended periods of operation.