---
id: CVE-2026-99078
title: 'net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry

  With AF_XDP on a striding RQ, mlx5e defers releasing XSK buffers until
  an MPWQE is refilled. If XSK a…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 4c2a1323680709078736a2886c754004e9fe42e6 <
    f3a52e2ec2788a7f6b64137985c087188a54ad4f
  - >-
    Linux >= 4c2a1323680709078736a2886c754004e9fe42e6 <
    d215d09606b0fcd18ad1eb532995782a21cea49d
  - >-
    Linux >= 4c2a1323680709078736a2886c754004e9fe42e6 <
    867119b4b588037724b85839d534465f0334d9bd
  - >-
    Linux >= 4c2a1323680709078736a2886c754004e9fe42e6 <
    3d73a1164a8c6b4461907a65cb6c022ea4fd39af
  - >-
    Linux >= 4c2a1323680709078736a2886c754004e9fe42e6 <
    63811edf512584c946e5e96b100e9e280703bbb5
  - Linux 6.4
published: '2026-10-23'
updated: '2026-10-24'
sourceUpdated: '2026-10-24T14:10:20.145Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99078'
references:
  - url: 'https://git.kernel.org/stable/c/f3a52e2ec2788a7f6b64137985c087188a54ad4f'
  - url: 'https://git.kernel.org/stable/c/d215d09606b0fcd18ad1eb532995782a21cea49d'
  - url: 'https://git.kernel.org/stable/c/867119b4b588037724b85839d534465f0334d9bd'
  - url: 'https://git.kernel.org/stable/c/3d73a1164a8c6b4461907a65cb6c022ea4fd39af'
  - url: 'https://git.kernel.org/stable/c/63811edf512584c946e5e96b100e9e280703bbb5'
tags:
  - cve.org
epss: 0.00225
epssPercentile: 0.1245
ingestedAt: '2026-10-23T13:24:55.512Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry

With AF_XDP on a striding RQ, mlx5e defers releasing XSK buffers until
an MPWQE is refilled. If XSK allocation then returns -ENOMEM,
actual_wq_head is not advanced and a later NAPI poll retries the same
WQE.

mlx5e_free_rx_mpwqe() leaves each released slot marked as releasable. On
retry it can therefore call xsk_buff_free() again through stale pointers
after the frames have returned to the XSK pool and been reallocated.

Set all skip_release_bitmap bits in the common error path of
mlx5e_xsk_alloc_rx_mpwqe(). This matches mlx5e_alloc_rx_mpwqe(). A
successful allocation already clears the bitmap after replacing every
buffer, so retries become idempotent without changing the success path.

Fault injection forced three consecutive failures for one selected MPWQE.
Both an early allocation failure and a partial 8-of-16-buffer unwind
released the original 16 XSK buffers only once. Each error left a full
bitmap, the following NAPI retry skipped the release, and a later
successful allocation cleared it. A 20-second AF_XDP zero-copy pressure
run exercised 1,575,262 buffer allocation failures without invalid
descriptors, WQE errors, or kernel warnings.

## Affected

- `Linux >= 4c2a1323680709078736a2886c754004e9fe42e6 < f3a52e2ec2788a7f6b64137985c087188a54ad4f`
- `Linux >= 4c2a1323680709078736a2886c754004e9fe42e6 < d215d09606b0fcd18ad1eb532995782a21cea49d`
- `Linux >= 4c2a1323680709078736a2886c754004e9fe42e6 < 867119b4b588037724b85839d534465f0334d9bd`
- `Linux >= 4c2a1323680709078736a2886c754004e9fe42e6 < 3d73a1164a8c6b4461907a65cb6c022ea4fd39af`
- `Linux >= 4c2a1323680709078736a2886c754004e9fe42e6 < 63811edf512584c946e5e96b100e9e280703bbb5`
- `Linux 6.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.