Linux Kernel mlx5e driver: Stale AF_XDP buffer release on refill retry
Summary
A flaw in the mlx5e driver of the Linux kernel, used for NVIDIA/Mellanox ConnectX network cards, can cause a stale buffer pointer to free a buffer that is still in use. The same AF_XDP (zero-copy) UMEM frame can then be published twice, which may lead to data errors or crashes. The issue only applies to hosts using AF_XDP zero-copy on the legacy RQ path. The CNA rates it 9.8 (Critical), but NVD analysis was still pending at the time of writing.
Affected
- Linux kernel from 6.4 onward, introduced by commit 3f93f82988bc6b4104314bf9aa485d47fbb7e241 (per CNA data)
- Exact affected version ranges per distribution: Unknown.
Fixed in
- Stable fixes listed by OSV: 6.6.160, 6.12.113, 6.18.57, 7.2.11
- Upstream stable commits: 32bbb870078d, 34d1db2b18e1, 639522e5056c, 655f47477054, e01620844c5c
- Fix status in your distribution kernel: Unknown.
Workaround
Unknown. No vendor workaround found.
Exploitation
- Not known to be exploited in the wild.
- Not listed in CISA KEV.
- No public proof of concept found.
Our recommendation
- Check your distribution's kernel advisory for CVE-2026-99079 and confirm the stable fix is in your running kernel.
- Identify hosts with ConnectX NICs that run AF_XDP zero-copy workloads and prioritise them.
- Patch on the normal kernel update cycle; patch sooner for multi-tenant or packet-processing hosts.
- Do not rely on version numbers from third-party aggregators.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Ubuntu CVE tracker ubuntu.com
- NVD mirror (Vulners) vulners.com
- VulDB vuldb.com
- Linux stable commit 32bbb870078d git.kernel.org
- Linux stable commit 34d1db2b18e1 git.kernel.org
- Linux stable commit 639522e5056c git.kernel.org
- Linux stable commit 655f47477054 git.kernel.org
- Linux stable commit e01620844c5c git.kernel.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:43.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on refill retry When an XDP redirect to an AF_XDP socket fails because its RX ring is full, the XSK core frees the buffer. During the subsequent batched refill of a legacy cyclic RQ, mlx5e also releases the WQE's XSK buffer before allocating a replacement. If that refill succeeds only partially, a WQE left without a replacement retains its old buffer pointer. The buffer can meanwhile be allocated to another WQE. A later refill retry can then free the live buffer through the stale pointer and publish the same UMEM frame twice. Mark the WQE as released immediately after the driver-side free. The flag is already cleared when a replacement buffer is assigned, so refill retries no longer release stale pointers. The failure is silent and produces no kernel warning or splat. A standalone legacy cyclic-RQ zero-copy libxsk reproducer, using 64-byte UDP traffic offered at 12 Mpps, detected it: stock stopped after 2,854,914 packets in 4.094 seconds, with 4,542 xdp_rx_ring_full events and 64 ownership/double-publication errors. With this change it processed 356,904,225 packets in 30 seconds despite 571,405 xdp_rx_ring_full events, with no ownership or data errors.
NVD references (5)
- https://git.kernel.org/stable/c/32bbb870078d467479965c21bbc4960c57eea208
- https://git.kernel.org/stable/c/34d1db2b18e1c1d189e34dd51923e031815f88e3
- https://git.kernel.org/stable/c/639522e5056cade578a324acfa993ec6c9f7f5dc
- https://git.kernel.org/stable/c/655f47477054d19de3b138840be229a1a4490d0c
- https://git.kernel.org/stable/c/e01620844c5c88b6fcf819d171df8e3976a0e76f
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.