{"id":"CVE-2026-99047","kind":"vulnerability","aliases":["CVE-2026-99047"],"related":[],"title":"Linux kernel gve driver leaks AF_XDP buffers when queues stop","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ngve: fix XSK buffer leak when rings are stopped\n\nGVE does not free XSK buffers when resetting ring state as a part of\nstopping queues. This causes all XSK buffers which are posted to the\nNIC to be leaked.\n\nFree XSK buffers attached to an allocated buf_state when stopping rings.\n\nThis issue was hit in production.","summary":"In the Linux gve network driver, AF_XDP (XSK) buffers posted to the NIC are not freed when ring state is reset during queue stop. The sources describe this as a resource leak, and it was reported as hit in production.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["af-xdp","gcp","gve-driver","infrastructure","linux-kernel"],"not_affected_if":["no-af-xdp-workloads","no-gve-interface"],"how_to_check":"- Run `uname -r` and compare against the fixed kernel version listed in the NVD entry, unknown from the sources\n- Check whether the gve driver is in use with `lspci -k | grep -A3 -i gve` or `ethtool -i <interface>` (driver: gve)\n- Check whether AF_XDP sockets are in use on gve interfaces, unknown from the sources","fix":"- Update the Linux kernel to a release that includes the upstream gve XSK buffer fix, exact version unknown from the sources\n- Reboot into the patched kernel after updating","status":"open","published_at":"2026-10-23T13:17:28+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:54:09+00:00","updated_at":"2026-10-25T04:54:09+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T04:54:09Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream gve XSK buffer fix, exact version unknown from the sources\n- Reboot into the patched kernel after updating","reach":"local","title":"Linux kernel gve driver leaks AF_XDP buffers when queues stop","impact":"low","summary":"In the Linux gve network driver, AF_XDP (XSK) buffers posted to the NIC are not freed when ring state is reset during queue stop. The sources describe this as a resource leak, and it was reported as hit in production.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","gcp","gve-driver","af-xdp"],"confidence":0.5,"needs_auth":"no","worst_case":"Buffers leak over time, degrading or exhausting memory on affected hosts.","analyst_note":"Find the affected and fixed kernel version ranges from the NVD entry or the upstream stable commit for the gve XSK buffer leak.","how_to_check":"- Run `uname -r` and compare against the fixed kernel version listed in the NVD entry, unknown from the sources\n- Check whether the gve driver is in use with `lspci -k | grep -A3 -i gve` or `ethtool -i <interface>` (driver: gve)\n- Check whether AF_XDP sockets are in use on gve interfaces, unknown from the sources","needs_analyst":true,"not_affected_if":["no-gve-interface","no-af-xdp-workloads"],"who_is_affected":"Hosts and cloud VMs that run the Linux kernel with the gve driver, which is the Google Compute Engine virtual NIC, and that use AF_XDP sockets on it. Systems without gve interfaces or without XDP/AF_XDP workloads are unlikely to see the leak, but the sources do not say which kernel versions are affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000671,"input_tokens":3352,"output_tokens":671,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-99047':14A,17A 'af':6A,19B,35B 'af-xdp':18B 'alloc':125C 'attach':122C 'buf':126C 'buffer':8A,38B,83C,94C,109C,121C 'caus':106C 'cve':12A,15A 'describ':56B 'driver':4A,24B,34B 'fix':81C 'follow':75C 'free':92C,119C 'freed':45B 'gcp':21B 'gve':3A,23B,32B,80C,89C 'gve-driv':22B 'hit':67B,134C 'infrastructur':25B 'issu':132C 'kernel':2A,28B,73C 'leak':5A,61B,84C,118C 'linux':1A,27B,31B,72C 'linux-kernel':26B 'network':33B 'nic':42B,115C 'part':101C 'post':39B,112C 'product':69B,136C 'queue':10A,52B,104C 'report':65B 'reset':50B,96C 'resolv':79C 'resourc':60B 'ring':47B,86C,97C,130C 'sourc':55B 'state':48B,98C,127C 'stop':11A,53B,88C,103C,129C 'vulner':76C 'xdp':7A,20B,36B 'xsk':37B,82C,93C,108C,120C","nicknames":[],"mitigations":[],"who_affected":"Hosts and cloud VMs that run the Linux kernel with the gve driver, which is the Google Compute Engine virtual NIC, and that use AF_XDP sockets on it. Systems without gve interfaces or without XDP/AF_XDP workloads are unlikely to see the leak, but the sources do not say which kernel versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:28+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99047","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99047","severity":null,"published_at":"2026-10-23T13:17:28+00:00","modified_at":"2026-10-23T13:17:28+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}