---
id: CVE-2026-99046
title: 'gve: fix XSK buffer leak on error descriptor'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  gve: fix XSK buffer leak on error descriptor

  When the error bit is set in the RX completion descriptor, the buf_state
  and its attached buffer should be freed. In the c…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= c1fffc5d66a7147d557736c2341a511e0896d9ff <
    06656aaa7e43ae62b673c2244d27099b8b94a70d
  - >-
    Linux >= c1fffc5d66a7147d557736c2341a511e0896d9ff <
    889f763874855c575429f75946132a53c573aa14
  - >-
    Linux >= c1fffc5d66a7147d557736c2341a511e0896d9ff <
    9fed6a8ab8a5bacba2c709cb19d2dd6d2fa9112e
  - Linux 6.17
published: '2026-10-23'
updated: '2026-10-24'
sourceUpdated: '2026-10-24T14:10:10.249Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99046'
references:
  - url: 'https://git.kernel.org/stable/c/06656aaa7e43ae62b673c2244d27099b8b94a70d'
  - url: 'https://git.kernel.org/stable/c/889f763874855c575429f75946132a53c573aa14'
  - url: 'https://git.kernel.org/stable/c/9fed6a8ab8a5bacba2c709cb19d2dd6d2fa9112e'
tags:
  - cve.org
epss: 0.00206
epssPercentile: 0.10162
ingestedAt: '2026-10-23T13:24:55.524Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

gve: fix XSK buffer leak on error descriptor

When the error bit is set in the RX completion descriptor, the buf_state
and its attached buffer should be freed. In the case of AF_XDP ZC, the
XSK buffer was not freed, leading to a leak.

This issue was caught by LLM.

## Affected

- `Linux >= c1fffc5d66a7147d557736c2341a511e0896d9ff < 06656aaa7e43ae62b673c2244d27099b8b94a70d`
- `Linux >= c1fffc5d66a7147d557736c2341a511e0896d9ff < 889f763874855c575429f75946132a53c573aa14`
- `Linux >= c1fffc5d66a7147d557736c2341a511e0896d9ff < 9fed6a8ab8a5bacba2c709cb19d2dd6d2fa9112e`
- `Linux 6.17`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.