In the Linux kernel, the following vulnerability has been resolved: net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop In the… (CVE-2026-99028)

The Linux kernel's Xilinx axienet driver pre-submits RX buffers and holds in-flight TX buffers with SKBs DMA-mapped and freed only in completion callbacks. On ndo_stop(), dmaengine_terminate_sync() aborts descriptors without running callbacks, causing the driver to free only ring shells and leak SKBs and DMA mappings on each interface down event. With many RX buffers pre-posted, this leak can exhaust IOMMU aperture. The patch clears skb slots in TX and RX callbacks to mark live DMA buffers and ensures all such buffers are unmapped and freed on stop. It also adds a lock to prevent race conditions where a callback might resubmit buffers after termination has started, preventing use-after-free scenarios.

The vulnerability causes a resource leak of DMA-mapped buffers and SKBs during network interface shutdown, potentially exhausting IOMMU aperture resources. This could degrade system stability or network functionality over time due to resource exhaustion. There is no indication of direct code execution or privilege escalation from the provided data.

A fix has been implemented in the Linux kernel to properly free all outstanding DMA buffers on dmaengine stop and to prevent race conditions during driver teardown. Users should update to the fixed kernel version containing this patch. No additional mitigation steps are indicated.