---
id: "CVE-2026-99028"
kind: "vulnerability"
aliases: ["CVE-2026-99028"]
title: "Linux kernel: Xilinx AXI Ethernet leaks DMA buffers on interface down"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["embedded", "fpga", "linux-kernel", "other", "xilinx-axienet"]
not_affected_if: ["no-axienet-hardware", "non-dmaengine-path"]
published_at: "2026-10-23T13:17:25+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T04:54:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99028", "first_seen_at": "2026-10-23T21:57:33+00:00"}]
---

# Linux kernel: Xilinx AXI Ethernet leaks DMA buffers on interface down

In the Linux kernel's Xilinx AXI Ethernet driver, buffers still held by the DMA engine are not freed when the interface is brought down, so each ifdown leaks socket buffers and their DMA mappings. The sources describe this as a resource leak that can eventually exhaust a limited IOMMU aperture; they do not describe code execution or data theft.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- Update the Linux kernel to a release that includes the upstream commit fixing the axienet dmaengine teardown path; the sources do not name a fixed version.

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99028

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop

In the dmaengine path the driver pre-submits RX buffers and holds
in-flight TX buffers whose SKBs are DMA-mapped by the driver and freed
only in the completion callbacks. On ndo_stop() dmaengine_terminate_sync()
aborts these descriptors without running their callbacks, and the driver
then frees only the ring shells, leaking every SKB still owned by the
engine and its DMA mapping on each ifdown. With 128 RX buffers pre-posted
per channel, the mapping leak can eventually exhaust a limited IOMMU
aperture.

Clear the slot's skb in the TX and RX callbacks so a non-NULL skb marks a
slot that still owns a live, DMA-mapped buffer, and on stop unmap and free
every such buffer.

axienet_dma_rx_cb() runs from the DMA tasklet and re-arms the RX ring on
each completion, so it can race axienet_stop(): a completion may submit a
fresh buffer after dmaengine_terminate_sync() has returned, leaving the
channel armed with a buffer the teardown then frees while the engine may
still write into it (dma_release_channel() does not stop it either). Add a
lock that axienet_dma_rx_cb() holds across the @stopping check and the
resubmit, and axienet_stop() holds to set @stopping before terminating.
Once @stopping is set no callback can arm a new buffer, and any armed just
before is aborted by the terminate, so teardown only frees buffers the
engine no longer owns.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_