CVE-2026-99078 in Linux
Summary
by MITRE • 10/23/2026
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
With AF_XDP on a striding RQ, mlx5e defers releasing XSK buffers until an MPWQE is refilled. If XSK allocation then returns -ENOMEM, actual_wq_head is not advanced and a later NAPI poll retries the same WQE.
mlx5e_free_rx_mpwqe() leaves each released slot marked as releasable. On retry it can therefore call xsk_buff_free() again through stale pointers after the frames have returned to the XSK pool and been reallocated.
Set all skip_release_bitmap bits in the common error path of mlx5e_xsk_alloc_rx_mpwqe(). This matches mlx5e_alloc_rx_mpwqe(). A successful allocation already clears the bitmap after replacing every buffer, so retries become idempotent without changing the success path.
Fault injection forced three consecutive failures for one selected MPWQE. Both an early allocation failure and a partial 8-of-16-buffer unwind released the original 16 XSK buffers only once. Each error left a full bitmap, the following NAPI retry skipped the release, and a later successful allocation cleared it. A 20-second AF_XDP zero-copy pressure run exercised 1,575,262 buffer allocation failures without invalid descriptors, WQE errors, or kernel warnings.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in the Linux kernel network driver mlx5e involves a critical flaw in the handling of Extended Direct Access (XDP) sockets when operating with Multi-Part Work Queue Elements on striding Receive Queues. This issue specifically manifests during buffer allocation failures, leading to potential double-free conditions that can compromise system stability and security. The core mechanism relies on deferring the release of XSK buffers until an MPWQE is refilled to optimize performance in high-throughput scenarios. However, when the kernel encounters a memory allocation error returning -ENOMEM, it fails to advance the actual work queue head pointer correctly. This oversight causes subsequent Network Interface Polling cycles to retry processing the same Work Queue Element with stale state information rather than advancing past the failed operation.
The technical flaw lies in how release flags are managed during these retries. The function mlx5e_free_rx_mpwqe marks each released slot as releasable, which is appropriate for successful operations but dangerous when combined with allocation failures. If a retry occurs after an -ENOMEM error, the driver may invoke xsk_buff_free again on pointers that have already been returned to the XSK pool and potentially reallocated by other processes or threads. This results in use-after-free scenarios where memory previously freed is accessed again, violating memory safety principles and creating opportunities for exploitation such as arbitrary code execution or denial of service through kernel panic.
From a vulnerability classification perspective, this issue aligns with CWE-415 Double Free, which occurs when an application calls free on the same pointer more than once, typically because of a programming error that fails to properly track allocated memory status. Additionally, it relates to CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization if the stale pointers lead to race conditions during reallocation. In terms of MITRE ATT&CK mapping, this vulnerability could be leveraged for Defense Evasion or Privilege Escalation by an attacker who can trigger repeated allocation failures under load, potentially leading to kernel memory corruption that bypasses standard security controls like KASLR or stack protectors depending on the specific exploitation vector.
The operational impact of this flaw includes potential system crashes, data corruption within network buffers, and degradation of performance due to error handling overheads when faults occur frequently. Under heavy traffic conditions with AF_XDP enabled, repeated allocation failures could trigger these buggy code paths repeatedly, leading to instability in high-performance networking environments where zero-copy mechanisms are critical for throughput optimization. The lack of proper state management means that transient memory pressure can escalate into persistent kernel-level issues if not mitigated promptly through patching or configuration changes.
To mitigate this vulnerability, the fix involves setting all skip_release_bitmap bits in the common error path of mlx5e_xsk_alloc_rx_mpwqe. This ensures that retries become idempotent without altering the success path logic, effectively preventing double-free attempts by marking buffers as non-releasable when allocation fails partway through a batch operation. System administrators should apply kernel updates containing this patch immediately to restore safe buffer management practices. Additionally, monitoring for high rates of XDP socket allocation failures can serve as an early warning indicator that the system is approaching memory limits where this vulnerability might be triggered, allowing for proactive resource scaling or load balancing adjustments before stability issues arise.