CVE-2026-99057None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: xen/netfront: don't leak the skb when xennet_fill_frags() fails When a response chain has more slots than fit in the skb's frags, xennet_fill_frags() returns an error …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
In the Linux kernel, the following vulnerability has been resolved:
xen/netfront: don't leak the skb when xennet_fill_frags() fails
When a response chain has more slots than fit in the skb's frags, xennet_fill_frags() returns an error and xennet_poll() jumps to its error path. That path moves what's left on tmpq to errq to be freed, but the skb being filled was already dequeued from tmpq, so it's never freed. Each chain that overflows leaks the skb and the pages attached to it as frags, and the backend decides how many slots it sends.
Put the skb back on tmpq before taking the error path, like the xennet_set_skb_gso() failure just above it does.
Linux >= ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c < 5051df031144753d3e18862514969146b601d089Linux >= ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c < 99011a11c97340ef7290df7dc199305c73fab2f2Linux >= ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c < 086944c1c2cbb683543bc3ff08637847b03c8009Linux >= ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c < 84e3ea6502b5f14ce8d499d0b6e0e38386274cf0Linux >= ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c < 93ccaf1c26e2133396173b76a071e59024daa622Linux bd1468048aa3e2af865da92990539946d4483989Linux 29a6193c0d74390c004808441061ac1812cf6f51Linux 7eced4478f4ec6ff0a603ddfd6e24a5d3831fca7Linux b73a161e9beff24bf1803ba393dff95a255268f9Linux >= 4.4.159 < 4.5Linux >= 4.9.130 < 4.10Linux >= 4.14.73 < 4.15Linux >= 4.18.11 < 4.19Linux 4.19Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-38564High· 7.8bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE
CVE-2026-99092Noneriscv: patch: fix handling of bpf-jit execmem addresses
CVE-2026-99089NoneASoC: samsung: i2s: enable op_clk in probe to balance runtime PM
CVE-2026-99093Nonemm: don't schedule deferred kernel page table freeing while booting
CVE-2026-99088Nonenet: openvswitch: validate transport header presence in set_ipv6_addr
CVE-2026-99090Nonedrm/amdgpu: serialize vblank counter reads against GPU reset