In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry With AF_XDP on… (CVE-2026-99078)

The Linux kernel's mlx5e driver for AF_XDP with a striding receive queue (RQ) deferred releasing XSK buffers until an MPWQE refill. If buffer allocation failed with -ENOMEM, the work queue head was not advanced, causing retries of the same work queue entry (WQE). The function mlx5e_free_rx_mpwqe() marked released slots as releasable, so on retry, it could call xsk_buff_free() again on stale pointers after buffers had been returned and reallocated, risking double free. The fix sets all skip_release_bitmap bits in the common error path of mlx5e_xsk_alloc_rx_mpwqe(), making retries idempotent without affecting successful allocations. Fault injection tests confirmed the fix's effectiveness under repeated allocation failures and long zero-copy pressure runs.

The vulnerability could lead to double freeing of XSK buffers in the mlx5e driver, potentially causing memory corruption or kernel instability. However, extensive testing did not reveal invalid descriptors, WQE errors, or kernel warnings, suggesting the issue was contained to buffer management and did not cause broader kernel faults in tested scenarios.

A fix has been implemented in the Linux kernel mlx5e driver to address this issue. Users should apply the official kernel updates that include this patch. No additional mitigation actions are indicated beyond updating to the fixed kernel version.