{"id":"CVE-2026-99057","title":"xen/netfront: don't leak the skb when xennet_fill_frags() fails","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nxen/netfront: don't leak the skb when xennet_fill_frags() fails\n\nWhen a response chain has more slots than fit in the skb's frags,\nxennet_fill_frags() returns an error …","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c < 5051df031144753d3e18862514969146b601d089","Linux >= ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c < 99011a11c97340ef7290df7dc199305c73fab2f2","Linux >= ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c < 086944c1c2cbb683543bc3ff08637847b03c8009","Linux >= ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c < 84e3ea6502b5f14ce8d499d0b6e0e38386274cf0","Linux >= ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c < 93ccaf1c26e2133396173b76a071e59024daa622","Linux bd1468048aa3e2af865da92990539946d4483989","Linux 29a6193c0d74390c004808441061ac1812cf6f51","Linux 7eced4478f4ec6ff0a603ddfd6e24a5d3831fca7","Linux b73a161e9beff24bf1803ba393dff95a255268f9","Linux >= 4.4.159 < 4.5","Linux >= 4.9.130 < 4.10","Linux >= 4.14.73 < 4.15","Linux >= 4.18.11 < 4.19","Linux 4.19"],"published":"2026-10-23","updated":"2026-10-23","sourceUpdated":"2026-10-23T12:22:44.683Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-99057","references":[{"url":"https://git.kernel.org/stable/c/5051df031144753d3e18862514969146b601d089"},{"url":"https://git.kernel.org/stable/c/99011a11c97340ef7290df7dc199305c73fab2f2"},{"url":"https://git.kernel.org/stable/c/086944c1c2cbb683543bc3ff08637847b03c8009"},{"url":"https://git.kernel.org/stable/c/84e3ea6502b5f14ce8d499d0b6e0e38386274cf0"},{"url":"https://git.kernel.org/stable/c/93ccaf1c26e2133396173b76a071e59024daa622"}],"tags":["cve.org"],"ingestedAt":"2026-10-23T13:24:55.522Z","slug":"CVE-2026-99057","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nxen/netfront: don't leak the skb when xennet_fill_frags() fails\n\nWhen a response chain has more slots than fit in the skb's frags,\nxennet_fill_frags() returns an error and xennet_poll() jumps to its\nerror path.  That path moves what's left on tmpq to errq to be freed,\nbut the skb being filled was already dequeued from tmpq, so it's never\nfreed.  Each chain that overflows leaks the skb and the pages attached\nto it as frags, and the backend decides how many slots it sends.\n\nPut the skb back on tmpq before taking the error path, like the\nxennet_set_skb_gso() failure just above it does.\n\n## Affected\n\n- `Linux >= ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c < 5051df031144753d3e18862514969146b601d089`\n- `Linux >= ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c < 99011a11c97340ef7290df7dc199305c73fab2f2`\n- `Linux >= ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c < 086944c1c2cbb683543bc3ff08637847b03c8009`\n- `Linux >= ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c < 84e3ea6502b5f14ce8d499d0b6e0e38386274cf0`\n- `Linux >= ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c < 93ccaf1c26e2133396173b76a071e59024daa622`\n- `Linux bd1468048aa3e2af865da92990539946d4483989`\n- `Linux 29a6193c0d74390c004808441061ac1812cf6f51`\n- `Linux 7eced4478f4ec6ff0a603ddfd6e24a5d3831fca7`\n- `Linux b73a161e9beff24bf1803ba393dff95a255268f9`\n- `Linux >= 4.4.159 < 4.5`\n- `Linux >= 4.9.130 < 4.10`\n- `Linux >= 4.14.73 < 4.15`\n- `Linux >= 4.18.11 < 4.19`\n- `Linux 4.19`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}