{"id":"CVE-2026-99028","kind":"vulnerability","aliases":["CVE-2026-99028"],"related":[],"title":"Linux kernel: Xilinx AXI Ethernet leaks DMA buffers on interface down","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop\n\nIn the dmaengine path the driver pre-submits RX buffers and holds\nin-flight TX buffers whose SKBs are DMA-mapped by the driver and freed\nonly in the completion callbacks. On ndo_stop() dmaengine_terminate_sync()\naborts these descriptors without running their callbacks, and the driver\nthen frees only the ring shells, leaking every SKB still owned by the\nengine and its DMA mapping on each ifdown. With 128 RX buffers pre-posted\nper channel, the mapping leak can eventually exhaust a limited IOMMU\naperture.\n\nClear the slot's skb in the TX and RX callbacks so a non-NULL skb marks a\nslot that still owns a live, DMA-mapped buffer, and on stop unmap and free\nevery such buffer.\n\naxienet_dma_rx_cb() runs from the DMA tasklet and re-arms the RX ring on\neach completion, so it can race axienet_stop(): a completion may submit a\nfresh buffer after dmaengine_terminate_sync() has returned, leaving the\nchannel armed with a buffer the teardown then frees while the engine may\nstill write into it (dma_release_channel() does not stop it either). Add a\nlock that axienet_dma_rx_cb() holds across the @stopping check and the\nresubmit, and axienet_stop() holds to set @stopping before terminating.\nOnce @stopping is set no callback can arm a new buffer, and any armed just\nbefore is aborted by the terminate, so teardown only frees buffers the\nengine no longer owns.","summary":"In the Linux kernel's Xilinx AXI Ethernet driver, buffers still held by the DMA engine are not freed when the interface is brought down, so each ifdown leaks socket buffers and their DMA mappings. The sources describe this as a resource leak that can eventually exhaust a limited IOMMU aperture; they do not describe code execution or data theft.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","fpga","linux-kernel","other","xilinx-axienet"],"not_affected_if":["no-axienet-hardware","non-dmaengine-path"],"how_to_check":"- unknown","fix":"- Update the Linux kernel to a release that includes the upstream commit fixing the axienet dmaengine teardown path; the sources do not name a fixed version.","status":"open","published_at":"2026-10-23T13:17:25+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:54:26+00:00","updated_at":"2026-10-25T04:54:26+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T04:54:26Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit fixing the axienet dmaengine teardown path; the sources do not name a fixed version.","reach":"local","title":"Linux kernel: Xilinx AXI Ethernet leaks DMA buffers on interface down","impact":"low","summary":"In the Linux kernel's Xilinx AXI Ethernet driver, buffers still held by the DMA engine are not freed when the interface is brought down, so each ifdown leaks socket buffers and their DMA mappings. The sources describe this as a resource leak that can eventually exhaust a limited IOMMU aperture; they do not describe code execution or data theft.","category":"other","nicknames":[],"who_cares":["linux-kernel","embedded","fpga","xilinx-axienet"],"confidence":0.6,"needs_auth":"no","worst_case":"Memory and IOMMU mappings leak on each interface down, eventually exhausting the IOMMU aperture.","analyst_note":"","how_to_check":"- unknown","needs_analyst":false,"not_affected_if":["no-axienet-hardware","non-dmaengine-path"],"who_is_affected":"Systems running a Linux kernel with the Xilinx AXI Ethernet (axienet) driver using the dmaengine path, typically embedded or FPGA-based boards, where the interface is repeatedly brought down and up. Systems without this hardware or driver are not affected. The sources do not state whether an IOMMU is involved in typical deployments.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000657,"input_tokens":3783,"output_tokens":557,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-99028':13A,16A '128':178C 'abort':146C,341C 'across':308C 'add':299C 'apertur':76B,195C 'arm':246C,275C,331C,337C 'axi':4A,32B 'axienet':25B,98C,234C,257C,303C,316C 'brought':49B 'buffer':8A,35B,56B,102C,116C,123C,180C,224C,233C,265C,278C,334C,349C 'callback':139C,152C,206C,329C 'cb':237C,306C 'channel':185C,274C,293C 'check':311C 'clear':196C 'code':81B 'complet':138C,252C,260C 'cve':11A,14A 'data':84B 'describ':63B,80B 'descriptor':148C 'dma':7A,40B,59B,101C,128C,172C,222C,235C,241C,291C,304C 'dma-map':127C,221C 'dmaengin':104C,108C,143C,267C 'driver':34B,111C,132C,155C 'either':298C 'embed':17B 'engin':41B,169C,285C,351C 'ethernet':5A,33B 'eventu':71B,190C 'everi':163C,231C 'execut':82B 'exhaust':72B,191C 'flight':121C 'follow':91C 'fpga':18B 'free':99C,157C,230C,282C,348C 'freed':44B,134C 'fresh':264C 'held':37B 'hold':118C,307C,318C 'ifdown':53B,176C 'in-flight':119C 'interfac':10A,47B 'iommu':75B,194C 'kernel':2A,21B,29B,89C 'leak':6A,54B,68B,162C,188C 'leav':272C 'limit':74B,193C 'linux':1A,20B,28B,88C 'linux-kernel':19B 'live':220C 'lock':301C 'longer':353C 'map':60B,129C,173C,187C,223C 'mark':213C 'may':261C,286C 'ndo':141C 'net':96C 'new':333C 'non':210C 'non-nul':209C 'null':211C 'outstand':100C 'own':166C,218C,354C 'path':109C 'per':184C 'post':183C 'pre':113C,182C 'pre-post':181C 'pre-submit':112C 'race':256C 're':245C 're-arm':244C 'releas':292C 'resolv':95C 'resourc':67B 'resubmit':314C 'return':271C 'ring':160C,249C 'run':150C,238C 'rx':115C,179C,205C,236C,248C,305C 'set':320C,327C 'shell':161C 'skb':164C,200C,212C 'skbs':125C 'slot':198C,215C 'socket':55B 'sourc':62B 'still':36B,165C,217C,287C 'stop':105C,142C,227C,258C,296C,310C,317C,321C,325C 'submit':114C,262C 'sync':145C,269C 'tasklet':242C 'teardown':280C,346C 'termin':144C,268C,323C,344C 'theft':85B 'tx':122C,203C 'unmap':228C 'vulner':92C 'whose':124C 'without':149C 'write':288C 'xilinx':3A,24B,31B,97C 'xilinx-axienet':23B","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the Xilinx AXI Ethernet (axienet) driver using the dmaengine path, typically embedded or FPGA-based boards, where the interface is repeatedly brought down and up. Systems without this hardware or driver are not affected. The sources do not state whether an IOMMU is involved in typical deployments.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:25+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99028","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99028","severity":null,"published_at":"2026-10-23T13:17:25+00:00","modified_at":"2026-10-23T13:17:25+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}