{"schema":"threatline.record/2","record":{"id":"CVE-2026-99057","aliases":[],"summary":"xen/netfront: don't leak the skb when xennet_fill_frags() fails","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nxen/netfront: don't leak the skb when xennet_fill_frags() fails\n\nWhen a response chain has more slots than fit in the skb's frags,\nxennet_fill_frags() returns an error and xennet_poll() jumps to its\nerror path.  That path moves what's left on tmpq to errq to be freed,\nbut the skb being filled was already dequeued from tmpq, so it's never\nfreed.  Each chain that overflows leaks the skb and the pages attached\nto it as frags, and the backend decides how many slots it sends.\n\nPut the skb back on tmpq before taking the error path, like the\nxennet_set_skb_gso() failure just above it does.","categories":["Operating systems"],"product":"Linux","vendor":"Linux","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-99057","source_modified_at":"2026-10-23T12:22:44.683Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Linux","vendor":"Linux","versions":[{"version":"ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c","lessThan":"5051df031144753d3e18862514969146b601d089","status":"affected","versionType":"git"},{"version":"ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c","lessThan":"99011a11c97340ef7290df7dc199305c73fab2f2","status":"affected","versionType":"git"},{"version":"ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c","lessThan":"086944c1c2cbb683543bc3ff08637847b03c8009","status":"affected","versionType":"git"},{"version":"ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c","lessThan":"84e3ea6502b5f14ce8d499d0b6e0e38386274cf0","status":"affected","versionType":"git"},{"version":"ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c","lessThan":"93ccaf1c26e2133396173b76a071e59024daa622","status":"affected","versionType":"git"},{"version":"bd1468048aa3e2af865da92990539946d4483989","status":"affected","versionType":"git"},{"version":"29a6193c0d74390c004808441061ac1812cf6f51","status":"affected","versionType":"git"},{"version":"7eced4478f4ec6ff0a603ddfd6e24a5d3831fca7","status":"affected","versionType":"git"},{"version":"b73a161e9beff24bf1803ba393dff95a255268f9","status":"affected","versionType":"git"},{"version":"4.4.159","lessThan":"4.5","status":"affected","versionType":"semver"},{"version":"4.9.130","lessThan":"4.10","status":"affected","versionType":"semver"},{"version":"4.14.73","lessThan":"4.15","status":"affected","versionType":"semver"},{"version":"4.18.11","lessThan":"4.19","status":"affected","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-99057","source_modified_at":"2026-10-23T12:22:44.683Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Linux","vendor":"Linux","versions":[{"version":"4.19","status":"affected"},{"version":"0","lessThan":"4.19","status":"unaffected","versionType":"semver"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.113","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.57","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.11","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-99057","source_modified_at":"2026-10-23T12:22:44.683Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Linux","ecosystem":null},"version":"5051df031144753d3e18862514969146b601d089","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-99057","source_modified_at":"2026-10-23T12:22:44.683Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Linux","ecosystem":null},"version":"99011a11c97340ef7290df7dc199305c73fab2f2","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-99057","source_modified_at":"2026-10-23T12:22:44.683Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Linux","ecosystem":null},"version":"086944c1c2cbb683543bc3ff08637847b03c8009","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-99057","source_modified_at":"2026-10-23T12:22:44.683Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Linux","ecosystem":null},"version":"84e3ea6502b5f14ce8d499d0b6e0e38386274cf0","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-99057","source_modified_at":"2026-10-23T12:22:44.683Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Linux","ecosystem":null},"version":"93ccaf1c26e2133396173b76a071e59024daa622","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-99057","source_modified_at":"2026-10-23T12:22:44.683Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Linux","ecosystem":null},"version":"4.5","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-99057","source_modified_at":"2026-10-23T12:22:44.683Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Linux","ecosystem":null},"version":"4.10","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-99057","source_modified_at":"2026-10-23T12:22:44.683Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Linux","ecosystem":null},"version":"4.15","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-99057","source_modified_at":"2026-10-23T12:22:44.683Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Linux","ecosystem":null},"version":"4.19","basis":"first unaffected version stated in the CVE record"}],"cvss":null,"severity":null,"kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-23T12:22:44.683Z","modified_at":"2026-10-23T12:22:44.683Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-99057","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T12:22:44.683Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://git.kernel.org/stable/c/5051df031144753d3e18862514969146b601d089"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/99011a11c97340ef7290df7dc199305c73fab2f2"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/086944c1c2cbb683543bc3ff08637847b03c8009"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/84e3ea6502b5f14ce8d499d0b6e0e38386274cf0"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/93ccaf1c26e2133396173b76a071e59024daa622"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-23T12:22:44.683Z","content_hash":"1601a7d0d1ab2f66b12076d07057930986307323aed9f4eac073e8b303a83131"}}