CVE-2026-99057
xen/netfront: don't leak the skb when xennet_fill_frags() fails
Fetching some sources has been requested. Reload in about a minute to see them.
Description
In the Linux kernel, the following vulnerability has been resolved: xen/netfront: don't leak the skb when xennet_fill_frags() fails When a response chain has more slots than fit in the skb's frags, xennet_fill_frags() returns an error and xennet_poll() jumps to its error path. That path moves what's left on tmpq to errq to be freed, but the skb being filled was already dequeued from tmpq, so it's never freed. Each chain that overflows leaks the skb and the pages attached to it as frags, and the backend decides how many slots it sends. Put the skb back on tmpq before taking the error path, like the xennet_set_skb_gso() failure just above it does.
Affected products and packages
CNA (CVE.org)
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | affected: ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c … < 5051df031144753d3e18862514969146b601d089 affected: ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c … < 99011a11c97340ef7290df7dc199305c73fab2f2 affected: ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c … < 086944c1c2cbb683543bc3ff08637847b03c8009 affected: ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c … < 84e3ea6502b5f14ce8d499d0b6e0e38386274cf0 affected: ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c … < 93ccaf1c26e2133396173b76a071e59024daa622 affected: bd1468048aa3e2af865da92990539946d4483989 affected: 29a6193c0d74390c004808441061ac1812cf6f51 affected: 7eced4478f4ec6ff0a603ddfd6e24a5d3831fca7 affected: b73a161e9beff24bf1803ba393dff95a255268f9 affected: 4.4.159 … < 4.5 affected: 4.9.130 … < 4.10 affected: 4.14.73 … < 4.15 affected: 4.18.11 … < 4.19 default: unaffected |
| Linux | Linux | affected: 4.19 unaffected: 0 … < 4.19 unaffected: 6.6.160 … <= 6.6.* unaffected: 6.12.113 … <= 6.12.* unaffected: 6.18.57 … <= 6.18.* unaffected: 7.2.11 … <= 7.2.* unaffected: 7.3 … <= * default: affected |
Open-source packages (GitHub Advisory / OSV)
xen/netfront: don't leak the skb when xennet_fill_frags() fails
| Ecosystem | Package | Affected versions | Fixed in |
|---|---|---|---|
| >= ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c, < 5051df031144753d3e18862514969146b601d089; < 99011a11c97340ef7290df7dc199305c73fab2f2; < 086944c1c2cbb683543bc3ff08637847b03c8009; < 84e3ea6502b5f14ce8d499d0b6e0e38386274cf0; < 93ccaf1c26e2133396173b76a071e59024daa622; >= 4.4.159, < 4.5; >= 4.9.130, < 4.10; >= 4.14.73, < 4.15; >= 4.18.11, < 4.19; >= bd1468048aa3e2af865da92990539946d4483989; >= 29a6193c0d74390c004808441061ac1812cf6f51; >= 7eced4478f4ec6ff0a603ddfd6e24a5d3831fca7; >= b73a161e9beff24bf1803ba393dff95a255268f9 v4.4.302, v4.4.301, v4.4.300, v4.4.299, v4.4.298, v4.4.297, v4.4.296, v4.4.295, v4.4.294, v4.4.293, v4.4.292, v4.4.291, v4.4.290, v4.4.289, v4.4.288, v4.4.287, v4.4.286, v4.4.285, v4.4.284, v4.4.283, … (+606) | 5051df031144753d3e18862514969146b601d089, 99011a11c97340ef7290df7dc199305c73fab2f2, 086944c1c2cbb683543bc3ff08637847b03c8009, 84e3ea6502b5f14ce8d499d0b6e0e38386274cf0, 93ccaf1c26e2133396173b76a071e59024daa622, 4.5, 4.10, 4.15, 4.19 | ||
| Linux | Kernel | >= 4.19.0, < 6.6.160; >= 6.7.0, < 6.12.113; >= 6.13.0, < 6.18.57; >= 6.19.0, < 7.2.11 | 6.6.160, 6.12.113, 6.18.57, 7.2.11 |
Linux distribution status
References (8)
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git OSV
- https://git.kernel.org/stable/c/086944c1c2cbb683543bc3ff08637847b03c8009 NVD, CNA, OSV
- https://git.kernel.org/stable/c/5051df031144753d3e18862514969146b601d089 NVD, CNA, OSV
- https://git.kernel.org/stable/c/84e3ea6502b5f14ce8d499d0b6e0e38386274cf0 NVD, CNA, OSV
- https://git.kernel.org/stable/c/93ccaf1c26e2133396173b76a071e59024daa622 NVD, CNA, OSV
- https://git.kernel.org/stable/c/99011a11c97340ef7290df7dc199305c73fab2f2 NVD, CNA, OSV
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/99xxx/CVE-2026-99057.json OSV
- https://nvd.nist.gov/vuln/detail/CVE-2026-99057 OSV