CVE-2026-99079
net/mlx5e: Prevent stale XSK buffer release on refill retry
No known exploitation. No EPSS score yet. Fixed versions are out.
What to do
Find your product and version, then upgrade to the build on the right.
- LinuxAffected: ≥ 3f93f82988bc6b4104314bf9aa485d47fbb7e241, < 32bbb870078d467479965c21bbc4960c57eea208Upgrade to: 32bbb870078d467479965c21bbc4960c57eea208Affected: ≥ 3f93f82988bc6b4104314bf9aa485d47fbb7e241, < 34d1db2b18e1c1d189e34dd51923e031815f88e3Upgrade to: 34d1db2b18e1c1d189e34dd51923e031815f88e3Affected: ≥ 3f93f82988bc6b4104314bf9aa485d47fbb7e241, < 639522e5056cade578a324acfa993ec6c9f7f5dcUpgrade to: 639522e5056cade578a324acfa993ec6c9f7f5dcAffected: ≥ 3f93f82988bc6b4104314bf9aa485d47fbb7e241, < 655f47477054d19de3b138840be229a1a4490d0cUpgrade to: 655f47477054d19de3b138840be229a1a4490d0c + 1 more branchStated by: CVE record
Versions as the sources state them. Full version matrix after sign-in
What it is
From the CVE record
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on refill retry When an XDP redirect to an AF_XDP socket fails because its RX ring is full, the XSK core frees the buffer. During the subsequent batched refill of a legacy cyclic RQ, mlx5e also releases the WQE's XSK buffer before allocating a replacement. If that refill succeeds only partially, a WQE left without a replacement retains its old buffer pointer. The buffer can meanwhile be allocated to another WQE. A later refill retry can then free the live buffer through the stale pointer and publish the same UMEM frame twice. Mark the WQE as released immediately after the driver-side free. The flag is already cleared when a replacement buffer is assigned, so refill retries no longer release stale pointers. The failure is silent and produces no kernel warning or splat. A standalone legacy cyclic-RQ zero-copy libxsk reproducer, using 64-byte UDP traffic offered at 12 Mpps, detected it: stock stopped after 2,854,914 packets in 4.094 seconds, with 4,542 xdp_rx_ring_full events and 64 ownership/double-publication errors. With this change it processed 356,904,225 packets in 30 seconds despite 571,405 xdp_rx_ring_full events, with no ownership or data errors.
In plain language
No plain-language summary for this CVE yet.
Exploitation
Where each signal puts this CVE on the scale from published to confirmed exploited.
- CISA KEV
Not in the catalog. CISA has not confirmed exploitation.
- Public exploits
No public exploit or proof of concept found in the sources we track.
- EPSS
No EPSS score yet. New CVEs are usually scored within a few days.
Lifecycle
2 events over 0 days, from the signal feeds we watch.
- Publishedrecord updated
Affected products
Sources
Watch the software you run.
My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.
We'll flag the next CVE, public exploit or patch for Linux, not every advisory.
A free account adds
- The full version matrix and every affected product
- Exploit links, proofs of concept and Metasploit modules
- Email alerts for the products you watch
- The same data over REST API, MCP and CLI