In the Linux kernel, the following vulnerability has been resolved: xen/netfront: don't leak the skb when xennet_fill_frags() fails When a response… (CVE-2026-99057)

The Linux kernel xen/netfront driver had a flaw where, if xennet_fill_frags() encountered a response chain with more slots than the skb's fragment capacity, it returned an error and the subsequent error handling path failed to free the skb because it had already been dequeued from the temporary queue (tmpq). This caused a memory leak of the skb and its attached pages. The fix involves reinserting the skb back onto tmpq before taking the error path, aligning with the handling of similar failures in xennet_set_skb_gso().

This vulnerability causes a memory leak in the kernel when processing certain response chains in the xen/netfront driver. Over time, repeated exploitation could degrade system performance or stability due to resource exhaustion. There is no indication of direct code execution or privilege escalation from this issue.

A fix has been implemented in the Linux kernel to address this memory leak by properly managing the skb in error conditions. Users should apply the official kernel updates that include this patch. Since no vendor advisory or patch links are provided, check the Linux kernel mailing lists or official repositories for the relevant patch and update guidance.