In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on refill retry When an XDP redirect… (CVE-2026-99079)

The Linux kernel vulnerability CVE-2026-99079 affects the mlx5e driver handling XDP redirects to AF_XDP sockets. When the RX ring is full, the XSK core frees buffers, and during a batched refill of a legacy cyclic receive queue, mlx5e releases the WQE's XSK buffer before allocating a replacement. If the refill only partially succeeds, some WQEs retain stale buffer pointers. These stale pointers can lead to freeing live buffers twice and publishing the same UMEM frame multiple times. The fix involves marking WQEs as released immediately after freeing the buffer, preventing stale pointer release on refill retries. Testing showed the fix dramatically improved packet processing without ownership or data errors.

The vulnerability can cause double freeing of live buffers and double publication of UMEM frames in the kernel's network stack. This can lead to memory corruption and data integrity issues in high-performance packet processing scenarios using XDP and AF_XDP sockets. The failure is silent with no kernel warnings, potentially complicating detection. However, no known exploits are reported in the wild.

A fix has been implemented in the Linux kernel to address this issue by marking WQEs as released immediately after freeing buffers, preventing stale pointer reuse on refill retries. Users should update to the fixed kernel version once available. Since this is a kernel-level fix, upgrading the Linux kernel to a version containing this patch is the recommended remediation. Patch status is not explicitly stated in the input; check the vendor advisory or Linux kernel release notes for the specific fixed version.