Riskcovery

CVE-2026-99057

xen/netfront: don't leak the skb when xennet_fill_frags() fails

State
Published
Severity
Not scored
Published
Oct 23, 2026
Updated
Oct 30, 2026
Reserved
Sep 25, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

xen/netfront: don't leak the skb when xennet_fill_frags() fails

When a response chain has more slots than fit in the skb's frags, xennet_fill_frags() returns an error and xennet_poll() jumps to its error path. That path moves what's left on tmpq to errq to be freed, but the skb being filled was already dequeued from tmpq, so it's never freed. Each chain that overflows leaks the skb and the pages attached to it as frags, and the backend decides how many slots it sends.

Put the skb back on tmpq before taking the error path, like the xennet_set_skb_gso() failure just above it does.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c to before 6e6bd1051daabc327233c3ca3d00613fc6783c8eAffected
  • ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c to before 0cf0a25a639c535146c5eb4480d256995721aed6Affected
  • ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c to before 53a131eb2a998c77e2851401b32b712d6c6e8487Affected
  • ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c to before 5051df031144753d3e18862514969146b601d089Affected
  • ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c to before 99011a11c97340ef7290df7dc199305c73fab2f2Affected
  • ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c to before 086944c1c2cbb683543bc3ff08637847b03c8009Affected
  • ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c to before 84e3ea6502b5f14ce8d499d0b6e0e38386274cf0Affected
  • ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c to before 93ccaf1c26e2133396173b76a071e59024daa622Affected
  • bd1468048aa3e2af865da92990539946d4483989Affected
  • 29a6193c0d74390c004808441061ac1812cf6f51Affected
  • 7eced4478f4ec6ff0a603ddfd6e24a5d3831fca7Affected
  • b73a161e9beff24bf1803ba393dff95a255268f9Affected
  • 4.4.159 to before 4.5Affected
  • 4.9.130 to before 4.10Affected
  • 4.14.73 to before 4.15Affected
  • 4.18.11 to before 4.19Affected
LinuxLinux
  • 4.19Affected
  • before 4.19Not affected
  • 5.10.273 through 5.10.*Not affected
  • 5.15.224 through 5.15.*Not affected
  • 6.1.191 through 6.1.*Not affected
  • 6.6.160 through 6.6.*Not affected
  • 6.12.113 through 6.12.*Not affected
  • 6.18.57 through 6.18.*Not affected
  • 7.2.11 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.