CVE-2026-99046
gve: fix XSK buffer leak on error descriptor
Fetching some sources has been requested. Reload in about a minute to see them.
CVSS v3.1 (listed by NVD)
7.5
HIGH
Scored by Linux (not yet scored by NVD)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0 (listed by NVD)
—
Not scored
CVSS (listed by CVE.org)
7.5
HIGH
Scored by CNA (Linux) · v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS exploit probability
0.2%
Percentile 10.2%
as of 2026-10-24
CISA KEV
—
Not listed
Attack conditions and impact
Derived from the CNA (via NVD) CVSS 3.1 vector
NetworkNo authNo interaction
Confidentiality NIntegrity NAvailability H
This vulnerability may be exploitable over the internet without authentication or user interaction.
| Metric | Value | Meaning |
|---|---|---|
| Attack vector AV | N | Network |
| Attack complexity AC | L | Low (easy) |
| Privileges required PR | N | None |
| User interaction UI | N | None |
| Scope S | U | Unchanged |
| Confidentiality C | N | None |
| Integrity I | N | None |
| Availability A | H | High |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
NVD
In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak on error descriptor When the error bit is set in the RX completion descriptor, the buf_state and its attached buffer should be freed. In the case of AF_XDP ZC, the XSK buffer was not freed, leading to a leak. This issue was caught by LLM.
CVSS assessments
| Provider | Version | Score | Vector |
|---|---|---|---|
| NVD / 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary) | 3.1 | 7.5 HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CNA / Linux | 3.1 | 7.5 HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected products and packages
CNA (CVE.org)
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | affected: c1fffc5d66a7147d557736c2341a511e0896d9ff … < 06656aaa7e43ae62b673c2244d27099b8b94a70d affected: c1fffc5d66a7147d557736c2341a511e0896d9ff … < 889f763874855c575429f75946132a53c573aa14 affected: c1fffc5d66a7147d557736c2341a511e0896d9ff … < 9fed6a8ab8a5bacba2c709cb19d2dd6d2fa9112e default: unaffected |
| Linux | Linux | affected: 6.17 unaffected: 0 … < 6.17 unaffected: 6.18.57 … <= 6.18.* unaffected: 7.2.11 … <= 7.2.* unaffected: 7.3 … <= * default: affected |
Open-source packages (GitHub Advisory / OSV)
CVE-2026-99046
OSV
gve: fix XSK buffer leak on error descriptor
| Ecosystem | Package | Affected versions | Fixed in |
|---|---|---|---|
| >= c1fffc5d66a7147d557736c2341a511e0896d9ff, < 06656aaa7e43ae62b673c2244d27099b8b94a70d; < 889f763874855c575429f75946132a53c573aa14; < 9fed6a8ab8a5bacba2c709cb19d2dd6d2fa9112e | 06656aaa7e43ae62b673c2244d27099b8b94a70d, 889f763874855c575429f75946132a53c573aa14, 9fed6a8ab8a5bacba2c709cb19d2dd6d2fa9112e | ||
| Linux | Kernel | >= 6.17.0, < 6.18.57; >= 6.19.0, < 7.2.11 | 6.18.57, 7.2.11 |
Linux distribution status
References (6)
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git OSV
- https://git.kernel.org/stable/c/06656aaa7e43ae62b673c2244d27099b8b94a70d NVD, CNA, OSV
- https://git.kernel.org/stable/c/889f763874855c575429f75946132a53c573aa14 NVD, CNA, OSV
- https://git.kernel.org/stable/c/9fed6a8ab8a5bacba2c709cb19d2dd6d2fa9112e NVD, CNA, OSV
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/99xxx/CVE-2026-99046.json OSV
- https://nvd.nist.gov/vuln/detail/CVE-2026-99046 OSV