---
id: CVE-2026-99057
title: 'xen/netfront: don''t leak the skb when xennet_fill_frags() fails'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  xen/netfront: don't leak the skb when xennet_fill_frags() fails

  When a response chain has more slots than fit in the skb's frags,
  xennet_fill_frags() returns an error …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c <
    5051df031144753d3e18862514969146b601d089
  - >-
    Linux >= ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c <
    99011a11c97340ef7290df7dc199305c73fab2f2
  - >-
    Linux >= ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c <
    086944c1c2cbb683543bc3ff08637847b03c8009
  - >-
    Linux >= ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c <
    84e3ea6502b5f14ce8d499d0b6e0e38386274cf0
  - >-
    Linux >= ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c <
    93ccaf1c26e2133396173b76a071e59024daa622
  - Linux bd1468048aa3e2af865da92990539946d4483989
  - Linux 29a6193c0d74390c004808441061ac1812cf6f51
  - Linux 7eced4478f4ec6ff0a603ddfd6e24a5d3831fca7
  - Linux b73a161e9beff24bf1803ba393dff95a255268f9
  - Linux >= 4.4.159 < 4.5
  - Linux >= 4.9.130 < 4.10
  - Linux >= 4.14.73 < 4.15
  - Linux >= 4.18.11 < 4.19
  - Linux 4.19
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T12:22:44.683Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99057'
references:
  - url: 'https://git.kernel.org/stable/c/5051df031144753d3e18862514969146b601d089'
  - url: 'https://git.kernel.org/stable/c/99011a11c97340ef7290df7dc199305c73fab2f2'
  - url: 'https://git.kernel.org/stable/c/086944c1c2cbb683543bc3ff08637847b03c8009'
  - url: 'https://git.kernel.org/stable/c/84e3ea6502b5f14ce8d499d0b6e0e38386274cf0'
  - url: 'https://git.kernel.org/stable/c/93ccaf1c26e2133396173b76a071e59024daa622'
tags:
  - cve.org
ingestedAt: '2026-10-23T13:24:55.522Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

xen/netfront: don't leak the skb when xennet_fill_frags() fails

When a response chain has more slots than fit in the skb's frags,
xennet_fill_frags() returns an error and xennet_poll() jumps to its
error path.  That path moves what's left on tmpq to errq to be freed,
but the skb being filled was already dequeued from tmpq, so it's never
freed.  Each chain that overflows leaks the skb and the pages attached
to it as frags, and the backend decides how many slots it sends.

Put the skb back on tmpq before taking the error path, like the
xennet_set_skb_gso() failure just above it does.

## Affected

- `Linux >= ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c < 5051df031144753d3e18862514969146b601d089`
- `Linux >= ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c < 99011a11c97340ef7290df7dc199305c73fab2f2`
- `Linux >= ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c < 086944c1c2cbb683543bc3ff08637847b03c8009`
- `Linux >= ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c < 84e3ea6502b5f14ce8d499d0b6e0e38386274cf0`
- `Linux >= ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c < 93ccaf1c26e2133396173b76a071e59024daa622`
- `Linux bd1468048aa3e2af865da92990539946d4483989`
- `Linux 29a6193c0d74390c004808441061ac1812cf6f51`
- `Linux 7eced4478f4ec6ff0a603ddfd6e24a5d3831fca7`
- `Linux b73a161e9beff24bf1803ba393dff95a255268f9`
- `Linux >= 4.4.159 < 4.5`
- `Linux >= 4.9.130 < 4.10`
- `Linux >= 4.14.73 < 4.15`
- `Linux >= 4.18.11 < 4.19`
- `Linux 4.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.