{"id":"CVE-2026-99028","title":"net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop\n\nIn the dmaengine path the driver pre-submits RX buffers and holds\nin-flight TX buffers whose SKBs …","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 6a91b846af85a24241decd686269e8e038eb13d1 < 079396129da5e7cb40ca0920aa1b9525bef6097c","Linux >= 6a91b846af85a24241decd686269e8e038eb13d1 < eececf7c3a679d9c08175ad6bacbc8c31848f5af","Linux >= 6a91b846af85a24241decd686269e8e038eb13d1 < 5e5cf3ad7c099ff86ea9e422cddb25a2e5317b58","Linux >= 6a91b846af85a24241decd686269e8e038eb13d1 < bcf2573a68a808a5b54cadafa72b6672e662c2bf","Linux 6.8"],"published":"2026-10-23","updated":"2026-10-23","sourceUpdated":"2026-10-23T12:21:20.294Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-99028","references":[{"url":"https://git.kernel.org/stable/c/079396129da5e7cb40ca0920aa1b9525bef6097c"},{"url":"https://git.kernel.org/stable/c/eececf7c3a679d9c08175ad6bacbc8c31848f5af"},{"url":"https://git.kernel.org/stable/c/5e5cf3ad7c099ff86ea9e422cddb25a2e5317b58"},{"url":"https://git.kernel.org/stable/c/bcf2573a68a808a5b54cadafa72b6672e662c2bf"}],"tags":["cve.org"],"ingestedAt":"2026-10-23T13:24:55.533Z","slug":"CVE-2026-99028","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop\n\nIn the dmaengine path the driver pre-submits RX buffers and holds\nin-flight TX buffers whose SKBs are DMA-mapped by the driver and freed\nonly in the completion callbacks. On ndo_stop() dmaengine_terminate_sync()\naborts these descriptors without running their callbacks, and the driver\nthen frees only the ring shells, leaking every SKB still owned by the\nengine and its DMA mapping on each ifdown. With 128 RX buffers pre-posted\nper channel, the mapping leak can eventually exhaust a limited IOMMU\naperture.\n\nClear the slot's skb in the TX and RX callbacks so a non-NULL skb marks a\nslot that still owns a live, DMA-mapped buffer, and on stop unmap and free\nevery such buffer.\n\naxienet_dma_rx_cb() runs from the DMA tasklet and re-arms the RX ring on\neach completion, so it can race axienet_stop(): a completion may submit a\nfresh buffer after dmaengine_terminate_sync() has returned, leaving the\nchannel armed with a buffer the teardown then frees while the engine may\nstill write into it (dma_release_channel() does not stop it either). Add a\nlock that axienet_dma_rx_cb() holds across the @stopping check and the\nresubmit, and axienet_stop() holds to set @stopping before terminating.\nOnce @stopping is set no callback can arm a new buffer, and any armed just\nbefore is aborted by the terminate, so teardown only frees buffers the\nengine no longer owns.\n\n## Affected\n\n- `Linux >= 6a91b846af85a24241decd686269e8e038eb13d1 < 079396129da5e7cb40ca0920aa1b9525bef6097c`\n- `Linux >= 6a91b846af85a24241decd686269e8e038eb13d1 < eececf7c3a679d9c08175ad6bacbc8c31848f5af`\n- `Linux >= 6a91b846af85a24241decd686269e8e038eb13d1 < 5e5cf3ad7c099ff86ea9e422cddb25a2e5317b58`\n- `Linux >= 6a91b846af85a24241decd686269e8e038eb13d1 < bcf2573a68a808a5b54cadafa72b6672e662c2bf`\n- `Linux 6.8`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}