All vulnerabilities
CVE-2026-99057

Linux: xen/netfront: don't leak the skb when xennet_fill_frags() fails

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in5051df031144753d3e18862514969146b601d089Also 99011a11c97340ef7290df7dc199305c73fab2f2, 086944c1c2cbb683543bc3ff08637847b03c8009 and 6 moreCVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 5051df031144753d3e18862514969146b601d089LinuxCVE List
  • 99011a11c97340ef7290df7dc199305c73fab2f2LinuxCVE List
  • 086944c1c2cbb683543bc3ff08637847b03c8009LinuxCVE List
  • 84e3ea6502b5f14ce8d499d0b6e0e38386274cf0LinuxCVE List
  • 93ccaf1c26e2133396173b76a071e59024daa622LinuxCVE List
  • 4.5LinuxCVE List
Show all 9 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

xen/netfront: don't leak the skb when xennet_fill_frags() fails

When a response chain has more slots than fit in the skb's frags, xennet_fill_frags() returns an error and xennet_poll() jumps to its error path. That path moves what's left on tmpq to errq to be freed, but the skb being filled was already dequeued from tmpq, so it's never freed. Each chain that overflows leaks the skb and the pages attached to it as frags, and the backend decides how many slots it sends.

Put the skb back on tmpq before taking the error path, like the xennet_set_skb_gso() failure just above it does.

Text from CVE List

Affected versions 20

  • Linuxaffected: ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c before 5051df031144753d3e18862514969146b601d089CVE List
  • Linuxaffected: ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c before 99011a11c97340ef7290df7dc199305c73fab2f2CVE List
  • Linuxaffected: ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c before 086944c1c2cbb683543bc3ff08637847b03c8009CVE List
  • Linuxaffected: ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c before 84e3ea6502b5f14ce8d499d0b6e0e38386274cf0CVE List
  • Linuxaffected: ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c before 93ccaf1c26e2133396173b76a071e59024daa622CVE List
  • Linuxaffected: bd1468048aa3e2af865da92990539946d4483989CVE List
  • Linuxaffected: 29a6193c0d74390c004808441061ac1812cf6f51CVE List
  • Linuxaffected: 7eced4478f4ec6ff0a603ddfd6e24a5d3831fca7CVE List
  • Linuxaffected: b73a161e9beff24bf1803ba393dff95a255268f9CVE List
  • Linuxaffected: 4.4.159 before 4.5CVE List
  • Linuxaffected: 4.9.130 before 4.10CVE List
  • Linuxaffected: 4.14.73 before 4.15CVE List
  • Linuxaffected: 4.18.11 before 4.19CVE List
  • Linuxaffected: 4.19CVE List
  • Linuxunaffected: all versions before 4.19CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.57 through 6.18.*CVE List
  • Linuxunaffected: 7.2.11 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5