CVE-2026-99046

gve: fix XSK buffer leak on error descriptor

State: Published
Severity: 7.5 High
Published: Oct 23, 2026
Updated: Oct 24, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

gve: fix XSK buffer leak on error descriptor

When the error bit is set in the RX completion descriptor, the buf_state and its attached buffer should be freed. In the case of AF_XDP ZC, the XSK buffer was not freed, leading to a leak.

This issue was caught by LLM.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	c1fffc5d66a7147d557736c2341a511e0896d9ff to before 06656aaa7e43ae62b673c2244d27099b8b94a70dAffected c1fffc5d66a7147d557736c2341a511e0896d9ff to before 889f763874855c575429f75946132a53c573aa14Affected c1fffc5d66a7147d557736c2341a511e0896d9ff to before 9fed6a8ab8a5bacba2c709cb19d2dd6d2fa9112eAffected
LinuxLinux	6.17Affected before 6.17Not affected 6.18.57 through 6.18.Not affected 7.2.11 through 7.2.Not affected 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.