CVE-2026-99079 in Linux
Summary
by MITRE • 10/23/2026
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Prevent stale XSK buffer release on refill retry
When an XDP redirect to an AF_XDP socket fails because its RX ring is full, the XSK core frees the buffer. During the subsequent batched refill of a legacy cyclic RQ, mlx5e also releases the WQE's XSK buffer before allocating a replacement. If that refill succeeds only partially, a WQE left without a replacement retains its old buffer pointer.
The buffer can meanwhile be allocated to another WQE. A later refill retry can then free the live buffer through the stale pointer and publish the same UMEM frame twice.
Mark the WQE as released immediately after the driver-side free. The flag is already cleared when a replacement buffer is assigned, so refill retries no longer release stale pointers.
The failure is silent and produces no kernel warning or splat. A standalone legacy cyclic-RQ zero-copy libxsk reproducer, using 64-byte UDP traffic offered at 12 Mpps, detected it: stock stopped after 2,854,914 packets in 4.094 seconds, with 4,542 xdp_rx_ring_full events and 64 ownership/double-publication errors. With this change it processed 356,904,225 packets in 30 seconds despite 571,405 xdp_rx_ring_full events, with no ownership or data errors.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified as net/mlx5e: Prevent stale XSK buffer release on refill retry represents a critical race condition within the Linux kernel's network subsystem, specifically affecting the Mellanox mlx5e driver when handling AF_XDP sockets and zero-copy packet processing. This issue arises during the interaction between the eXpress Data Path (XDP) framework and the Receive Queue (RQ) management logic in legacy cyclic receive queues. The core of the flaw lies in the buffer lifecycle management for Extended Buffer Descriptors associated with XSK buffers, where improper state tracking leads to use-after-free scenarios that compromise memory integrity and network stability.
The technical mechanism triggering this vulnerability involves a specific sequence of events during packet reception when an XDP program attempts to redirect packets to an AF_XDP socket. If the destination RX ring is full, the redirection fails, prompting the XSK core to free the associated buffer back to the pool for reuse. However, in subsequent operations involving batched refills of legacy cyclic RQs, the mlx5e driver releases the Work Queue Element's (WQE) XSK buffer pointer before allocating a replacement buffer. This sequence creates a window where the WQE retains a reference to a buffer that has already been freed or is in the process of being reallocated. If this refill operation succeeds only partially, some WQEs remain without valid new buffers while still holding their original stale pointers.
This state inconsistency leads directly to severe memory safety violations. Because the stale pointer remains associated with the WQE, and the underlying buffer may have already been allocated to a different active WQE by another part of the system, subsequent refill retries can inadvertently free this live buffer again through the outdated reference. This results in double publication of Universal Memory (UMEM) frames, effectively causing use-after-free conditions where kernel memory is accessed or modified after it has been returned to the allocator for reuse by other processes or network streams. Such corruption can lead to data leakage, privilege escalation vectors if exploited carefully, or general system instability through corrupted heap structures within the kernel space.
The operational impact of this vulnerability is characterized by silent failures that do not generate standard kernel warnings or splats, making detection difficult without specialized testing tools. In high-throughput scenarios involving zero-copy networking, such as processing 64-byte UDP traffic at rates around 12 million packets per second, the system exhibits significant degradation in performance and reliability. Without mitigation, the stock implementation stops functioning correctly after a relatively small number of processed packets due to ownership conflicts and double-publication errors that corrupt packet data streams. This undermines the primary advantage of AF_XDP, which is high-performance, low-latency network processing with minimal CPU overhead.
To address this issue, the resolution involves modifying the driver logic to mark WQEs as released immediately after the driver-side free operation occurs. By setting a flag at this precise point in the execution flow, and ensuring that this flag is cleared only when a new replacement buffer is successfully assigned, the system prevents refill retries from acting on stale pointers. This synchronization ensures that buffers are not freed twice and maintains strict ownership semantics for memory frames throughout their lifecycle within the network stack. The effectiveness of this fix has been validated through rigorous testing using standalone legacy cyclic-RQ zero-copy reproducers, which demonstrated a dramatic increase in packet processing capacity and the elimination of data errors under heavy load conditions.
From a vulnerability classification perspective, this flaw aligns with CWE-416: Use After Free, as it involves accessing memory after it has been freed, leading to undefined behavior and potential security breaches. Additionally, because it impacts network stack integrity and can potentially be triggered remotely via crafted traffic patterns that induce RX ring full conditions, it relates to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor if the double-published buffers contain sensitive data from other connections. In terms of MITRE ATT&CK mapping, this vulnerability falls under T1564: Hide Execution Artifacts or more broadly within techniques that exploit memory corruption for denial of service or potential code execution, specifically relating to resource management errors in network drivers (T1203).
Mitigation strategies primarily involve applying the kernel patch provided by upstream Linux maintainers which implements the flag-based state tracking described. For environments where immediate patching is not feasible, administrators should consider limiting the maximum packet rate on affected interfaces or disabling AF_XDP zero-copy features if they are not strictly required for performance optimization. Monitoring network stack metrics for unusual drops in throughput or increased error counts related to XDP redirection can serve as an early warning indicator of exploitation attempts or active degradation due to this flaw. Regular updates to the kernel and mlx5e driver components remain the most effective defense against such low-level memory management vulnerabilities.