---
id: CVE-2026-31645
title: 'net: lan966x: fix page pool leak in error paths'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net: lan966x: fix page pool leak in error paths

  lan966x_fdma_rx_alloc() creates a page pool but does not destroy it if
  the subsequent fdma_alloc_coherent() call fails,…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 11871aba19748b3387e83a2db6360aa7119e9a1a <
    a229a4dc87302fa131f3394b09b0efd8c255a5ac
  - >-
    Linux >= 11871aba19748b3387e83a2db6360aa7119e9a1a <
    73e940c4249dc5ec6422d1fae535d192fb125955
  - >-
    Linux >= 11871aba19748b3387e83a2db6360aa7119e9a1a <
    22e1ee9f22b5c3bb702bb6d4167d770002a85b2b
  - >-
    Linux >= 11871aba19748b3387e83a2db6360aa7119e9a1a <
    4941e234cfd67ac911fb259642b453f9f76aac41
  - >-
    Linux >= 11871aba19748b3387e83a2db6360aa7119e9a1a <
    076344a6ad9d1308faaed1402fdcfdda68b604ab
  - Linux 6.2
published: '2026-04-24'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:39:37.535Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-31645'
references:
  - url: 'https://git.kernel.org/stable/c/a229a4dc87302fa131f3394b09b0efd8c255a5ac'
  - url: 'https://git.kernel.org/stable/c/73e940c4249dc5ec6422d1fae535d192fb125955'
  - url: 'https://git.kernel.org/stable/c/22e1ee9f22b5c3bb702bb6d4167d770002a85b2b'
  - url: 'https://git.kernel.org/stable/c/4941e234cfd67ac911fb259642b453f9f76aac41'
  - url: 'https://git.kernel.org/stable/c/076344a6ad9d1308faaed1402fdcfdda68b604ab'
tags:
  - cve.org
epss: 0.00162
epssPercentile: 0.04996
ingestedAt: '2026-10-21T12:48:53.661Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net: lan966x: fix page pool leak in error paths

lan966x_fdma_rx_alloc() creates a page pool but does not destroy it if
the subsequent fdma_alloc_coherent() call fails, leaking the pool.

Similarly, lan966x_fdma_init() frees the coherent DMA memory when
lan966x_fdma_tx_alloc() fails but does not destroy the page pool that
was successfully created by lan966x_fdma_rx_alloc(), leaking it.

Add the missing page_pool_destroy() calls in both error paths.

## Affected

- `Linux >= 11871aba19748b3387e83a2db6360aa7119e9a1a < a229a4dc87302fa131f3394b09b0efd8c255a5ac`
- `Linux >= 11871aba19748b3387e83a2db6360aa7119e9a1a < 73e940c4249dc5ec6422d1fae535d192fb125955`
- `Linux >= 11871aba19748b3387e83a2db6360aa7119e9a1a < 22e1ee9f22b5c3bb702bb6d4167d770002a85b2b`
- `Linux >= 11871aba19748b3387e83a2db6360aa7119e9a1a < 4941e234cfd67ac911fb259642b453f9f76aac41`
- `Linux >= 11871aba19748b3387e83a2db6360aa7119e9a1a < 076344a6ad9d1308faaed1402fdcfdda68b604ab`
- `Linux 6.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.