{"id":"CVE-2026-99078","kind":"vulnerability","aliases":["CVE-2026-99078"],"related":[],"title":"Linux kernel: mlx5e AF_XDP retry can double-free receive buffers","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry\n\nWith AF_XDP on a striding RQ, mlx5e defers releasing XSK buffers until\nan MPWQE is refilled. If XSK allocation then returns -ENOMEM,\nactual_wq_head is not advanced and a later NAPI poll retries the same\nWQE.\n\nmlx5e_free_rx_mpwqe() leaves each released slot marked as releasable. On\nretry it can therefore call xsk_buff_free() again through stale pointers\nafter the frames have returned to the XSK pool and been reallocated.\n\nSet all skip_release_bitmap bits in the common error path of\nmlx5e_xsk_alloc_rx_mpwqe(). This matches mlx5e_alloc_rx_mpwqe(). A\nsuccessful allocation already clears the bitmap after replacing every\nbuffer, so retries become idempotent without changing the success path.\n\nFault injection forced three consecutive failures for one selected MPWQE.\nBoth an early allocation failure and a partial 8-of-16-buffer unwind\nreleased the original 16 XSK buffers only once. Each error left a full\nbitmap, the following NAPI retry skipped the release, and a later\nsuccessful allocation cleared it. A 20-second AF_XDP zero-copy pressure\nrun exercised 1,575,262 buffer allocation failures without invalid\ndescriptors, WQE errors, or kernel warnings.","summary":"In the Linux kernel's mlx5e driver for Mellanox ConnectX NICs, an AF_XDP zero-copy receive path that failed a buffer allocation could retry and release buffers already returned to the XSK pool. The sources describe a use-after-free-style stale release, but do not state an attacker-facing impact.","severity":"unknown","cvss":null,"epss":0.00225,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["af-xdp","infrastructure","linux-kernel","mlx5","nvidia-connectx"],"not_affected_if":["no-af-xdp-zero-copy","no-mlx5-nic"],"how_to_check":"- `uname -r` and compare against the kernel version that contains the upstream fix\n- Check whether the mlx5_core driver is loaded with `lsmod | grep mlx5` and whether AF_XDP zero-copy sockets are in use\n- unknown","fix":"- Update the Linux kernel to a release that includes the upstream commit for net/mlx5e XSK MPWQE refill retry (fixed version unknown from sources)","status":"open","published_at":"2026-10-23T13:17:31+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T04:53:40+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T04:53:40Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit for net/mlx5e XSK MPWQE refill retry (fixed version unknown from sources)","reach":"local","title":"Linux kernel: mlx5e AF_XDP retry can double-free receive buffers","impact":"medium","summary":"In the Linux kernel's mlx5e driver for Mellanox ConnectX NICs, an AF_XDP zero-copy receive path that failed a buffer allocation could retry and release buffers already returned to the XSK pool. The sources describe a use-after-free-style stale release, but do not state an attacker-facing impact.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","mlx5","af-xdp","nvidia-connectx"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; sources describe stale buffer release on retry, impact not stated","analyst_note":"Confirm fixed kernel versions and the attacker-facing impact from the NVD entry and the upstream kernel commit.","how_to_check":"- `uname -r` and compare against the kernel version that contains the upstream fix\n- Check whether the mlx5_core driver is loaded with `lsmod | grep mlx5` and whether AF_XDP zero-copy sockets are in use\n- unknown","needs_analyst":true,"not_affected_if":["no-mlx5-nic","no-af-xdp-zero-copy"],"who_is_affected":"Systems running a Linux kernel with the mlx5e driver (Mellanox/NVIDIA ConnectX) that use AF_XDP zero-copy receive on striding RQ. Hosts without ConnectX NICs or without AF_XDP zero-copy sockets are unlikely to be exposed; the sources do not say more.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000702,"input_tokens":3725,"output_tokens":660,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-16':242C '-2026':14A,17A '-99078':15A,18A '1':284C '16':248C '20':274C '262':286C '575':285C '8':240C 'actual':128C 'advanc':133C 'af':4A,20B,42B,106C,276C 'af-xdp':19B 'alloc':53B,124C,193C,199C,204C,235C,270C,288C 'alreadi':59B,205C 'attack':82B 'attacker-fac':81B 'becom':215C 'bit':184C 'bitmap':183C,208C,258C 'buff':161C 'buffer':12A,52B,58B,99C,116C,212C,243C,250C,287C 'call':159C 'chang':218C 'clear':206C,271C 'common':187C 'connectx':29B,39B 'consecut':226C 'copi':46B,280C 'could':54B 'cve':13A,16A 'defer':113C 'describ':67B 'descriptor':292C 'doubl':9A 'double-fre':8A 'driver':36B 'earli':234C 'enomem':127C 'error':188C,254C,294C 'everi':211C 'exercis':283C 'face':83B 'fail':50B 'failur':227C,236C,289C 'fault':222C 'follow':90C,260C 'forc':224C 'frame':169C 'free':10A,72B,144C,162C 'full':257C 'head':130C 'idempot':216C 'impact':84B 'infrastructur':22B 'inject':223C 'invalid':291C 'kernel':2A,25B,33B,88C,296C 'later':136C,268C 'leav':147C 'left':255C 'linux':1A,24B,32B,87C 'linux-kernel':23B 'mark':151C 'match':197C 'mellanox':38B 'mlx5':26B 'mlx5e':3A,35B,112C,143C,191C,198C 'mpwqe':102C,119C,146C,195C,201C,231C 'napi':137C,261C 'net/mlx5e':95C 'nic':40B 'nvidia':28B 'nvidia-connectx':27B 'one':229C 'origin':247C 'partial':239C 'path':48B,189C,221C 'pointer':166C 'poll':138C 'pool':64B,175C 'pressur':281C 'prevent':96C 'realloc':178C 'receiv':11A,47B 'refil':103C,121C 'releas':57B,75B,100C,114C,149C,153C,182C,245C,265C 'replac':210C 'resolv':94C 'retri':6A,55B,104C,139C,155C,214C,262C 'return':60B,126C,171C 'rq':111C 'run':282C 'rx':145C,194C,200C 'second':275C 'select':230C 'set':179C 'skip':181C,263C 'slot':150C 'sourc':66B 'stale':74B,97C,165C 'state':79B 'stride':110C 'style':73B 'success':203C,220C,269C 'therefor':158C 'three':225C 'unwind':244C 'use':70B 'use-after-free-styl':69B 'vulner':91C 'warn':297C 'without':217C,290C 'wq':129C 'wqe':142C,293C 'xdp':5A,21B,43B,107C,277C 'xsk':63B,98C,115C,123C,160C,174C,192C,249C 'zero':45B,279C 'zero-copi':44B,278C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the mlx5e driver (Mellanox/NVIDIA ConnectX) that use AF_XDP zero-copy receive on striding RQ. Hosts without ConnectX NICs or without AF_XDP zero-copy sockets are unlikely to be exposed; the sources do not say more.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99078","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99078","severity":null,"published_at":"2026-10-23T13:17:31+00:00","modified_at":"2026-10-23T13:17:31+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-99078","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99078","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}