{"id":"CVE-2026-98486","kind":"vulnerability","aliases":["CVE-2026-98486"],"related":[],"title":"Linux kernel: ENA driver leaks a DMA buffer when probe fails","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ena: fix MMIO read buffer leak on probe failure\n\nena_device_init() initializes the MMIO read mechanism with\nena_com_mmio_reg_read_request_init(), which allocates a coherent DMA\nbuffer for MMIO read responses.\n\nThe normal removal path releases this buffer through\nena_com_mmio_reg_read_request_destroy(). However, if ena_probe() fails\nafter ena_device_init() succeeds, the error path destroys the admin\nresources and eventually frees ena_dev without destroying the MMIO read\nrequest, leaving the coherent DMA buffer allocated.\n\nCall ena_com_mmio_reg_read_request_destroy() in the probe error path\nbefore releasing the remaining device resources.\n\nThis issue was found by manual code inspection.","summary":"The Amazon ENA network driver in the Linux kernel does not free a coherent DMA buffer used for MMIO register reads when device probe fails partway through. The leak is a resource exhaustion issue found by code inspection, and the sources describe no code execution or data exposure.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aws-ec2","ena-driver","infrastructure","linux-kernel"],"not_affected_if":["no-ena-hardware","probe-succeeds"],"how_to_check":"- Check the running kernel with `uname -r` and compare it against the fixed kernel builds in the upstream stable tree or distribution advisories\n- Check whether the ENA driver is loaded with `lsmod | grep ena`","fix":"- Update to a kernel build that includes the upstream commit titled 'net: ena: fix MMIO read buffer leak on probe failure' (version unknown from the sources)\n- Reboot after the kernel update so the fixed driver is active","status":"open","published_at":"2026-10-18T16:16:59+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:25:46+00:00","updated_at":"2026-10-25T05:25:46+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:25:46Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a kernel build that includes the upstream commit titled 'net: ena: fix MMIO read buffer leak on probe failure' (version unknown from the sources)\n- Reboot after the kernel update so the fixed driver is active","reach":"local","title":"Linux kernel: ENA driver leaks a DMA buffer when probe fails","impact":"low","summary":"The Amazon ENA network driver in the Linux kernel does not free a coherent DMA buffer used for MMIO register reads when device probe fails partway through. The leak is a resource exhaustion issue found by code inspection, and the sources describe no code execution or data exposure.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","aws-ec2","ena-driver"],"confidence":0.5,"needs_auth":"no","worst_case":"A failed probe leaks kernel DMA memory until reboot","analyst_note":"Confirm the fixed kernel version and stable backport commits from the NVD entry and the kernel.org stable mailing list.","how_to_check":"- Check the running kernel with `uname -r` and compare it against the fixed kernel builds in the upstream stable tree or distribution advisories\n- Check whether the ENA driver is loaded with `lsmod | grep ena`","needs_analyst":true,"not_affected_if":["no-ena-hardware","probe-succeeds"],"who_is_affected":"Hosts that load the Amazon ENA network driver, typically AWS EC2 instances using Elastic Network Adapters, are the ones where the driver code runs. The leak only occurs when probe fails after device init, so systems that probe successfully are not exposed to growing leaks from it. Systems without the ENA driver loaded can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000666,"input_tokens":3496,"output_tokens":632,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98486':14A,17A 'admin':152C 'alloc':113C,170C 'amazon':29B 'aw':19B 'aws-ec2':18B 'buffer':8A,43B,91C,117C,128C,169C 'call':171C 'code':64B,71B,196C 'coher':41B,115C,167C 'com':106C,131C,173C 'cve':12A,15A 'data':74B 'describ':69B 'destroy':136C,150C,160C,178C 'dev':158C 'devic':50B,97C,144C,188C 'dma':7A,42B,116C,168C 'driver':4A,23B,32B 'ec2':20B 'ena':3A,22B,30B,87C,96C,105C,130C,139C,143C,157C,172C 'ena-driv':21B 'error':148C,182C 'eventu':155C 'execut':72B 'exhaust':60B 'exposur':75B 'fail':11A,52B,141C 'failur':95C 'fix':88C 'follow':81C 'found':62B,193C 'free':39B,156C 'howev':137C 'infrastructur':24B 'init':98C,111C,145C 'initi':99C 'inspect':65B,197C 'issu':61B,191C 'kernel':2A,27B,36B,79C 'leak':5A,56B,92C 'leav':165C 'linux':1A,26B,35B,78C 'linux-kernel':25B 'manual':195C 'mechan':103C 'mmio':46B,89C,101C,107C,119C,132C,162C,174C 'net':86C 'network':31B 'normal':123C 'partway':53B 'path':125C,149C,183C 'probe':10A,51B,94C,140C,181C 'read':48B,90C,102C,109C,120C,134C,163C,176C 'reg':108C,133C,175C 'regist':47B 'releas':126C,185C 'remain':187C 'remov':124C 'request':110C,135C,164C,177C 'resolv':85C 'resourc':59B,153C,189C 'respons':121C 'sourc':68B 'succeed':146C 'use':44B 'vulner':82C 'without':159C","nicknames":[],"mitigations":[],"who_affected":"Hosts that load the Amazon ENA network driver, typically AWS EC2 instances using Elastic Network Adapters, are the ones where the driver code runs. The leak only occurs when probe fails after device init, so systems that probe successfully are not exposed to growing leaks from it. Systems without the ENA driver loaded can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:16:59+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98486","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98486","severity":null,"published_at":"2026-10-18T16:16:59+00:00","modified_at":"2026-10-21T13:21:31+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}