In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on refill retry When an…
CVE-2026-99079 · GHSA-7w5x-75mg-qr73 · EUVD-2026-108745 · published 23 Oct 2026
How serious is it
- Severity: critical, CVSS score 9.8 out of 10.
- No exploit prediction (EPSS) score yet.
- Not on the CISA list of exploited vulnerabilities.
- No public exploit in Exploit-DB.
Is your app affected by CVE-2026-99079?
Paste this prompt into Claude Code, Cursor or any AI coding tool: it runs a free Shippable scan of your project and fixes what it finds. Built with Lovable, Bolt or v0? Scan your live app. Or upload your package file.
Who is affected
- Linux Linux: 6.4
- Linux Linux: 3f93f82988bc6b4104314bf9aa485d47fbb7e241 <639522e5056cade578a324acfa993ec6c9f7f5dc
- Linux Linux: patch: 6.12.113
- Linux Linux: patch: 7.2.11
- Linux Linux: patch: 6.18.57
- Linux Linux: 3f93f82988bc6b4104314bf9aa485d47fbb7e241 <e01620844c5c88b6fcf819d171df8e3976a0e76f
- Linux Linux: patch: 0
- Linux Linux: 3f93f82988bc6b4104314bf9aa485d47fbb7e241 <655f47477054d19de3b138840be229a1a4490d0c
- Linux Linux: patch: 7.3
- Linux Linux: 3f93f82988bc6b4104314bf9aa485d47fbb7e241 <34d1db2b18e1c1d189e34dd51923e031815f88e3
How to check
- Find out whether you run the affected product and which version, then compare it with the versions above.
How to fix
Copies a prompt for Claude Code, Cursor or Codex that asks it to check whether you run this product.
- Apply the vendor's update or mitigation from the references below. If there is none yet, limit exposure of the affected service until there is.
- If a vulnerable version was live, check your logs and rotate the secrets that server could read.
The advisory
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Prevent stale XSK buffer release on refill retry
When an XDP redirect to an AF_XDP socket fails because its RX ring is
full, the XSK core frees the buffer. During the subsequent batched refill
of a legacy cyclic RQ, mlx5e also releases the WQE's XSK buffer before
allocating a replacement. If that refill succeeds only partially, a WQE
left without a replacement retains its old buffer pointer.
The buffer can meanwhile be allocated to another WQE. A later refill
retry can then free the live buffer through the stale pointer and publish
the same UMEM frame twice.
Mark the WQE as released immediately after the driver-side free. The flag
is already cleared when a replacement buffer is assigned, so refill
retries no longer release stale pointers.
The failure is silent and produces no kernel warning or splat. A
standalone legacy cyclic-RQ zero-copy libxsk reproducer, using 64-byte UDP
traffic offered at 12 Mpps, detected it: stock stopped after 2,854,914
packets in 4.094 seconds, with 4,542 xdp_rx_ring_full events and 64
ownership/double-publication errors. With this change it processed
356,904,225 packets in 30 seconds despite 571,405 xdp_rx_ring_full events,
with no ownership or data errors.
Check your whole app
Dependencies are only half of it. Free and read-only: before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.
References
- git.kernel.org/stable/c/32bbb870078d467479965c21bbc4960c57eea208
- git.kernel.org/stable/c/34d1db2b18e1c1d189e34dd51923e031815f88e3
- git.kernel.org/stable/c/639522e5056cade578a324acfa993ec6c9f7f5dc
- git.kernel.org/stable/c/655f47477054d19de3b138840be229a1a4490d0c
- git.kernel.org/stable/c/e01620844c5c88b6fcf819d171df8e3976a0e76f
- nvd.nist.gov/vuln/detail/CVE-2026-99079
Merged from ENISA EUVD. Last updated 25 Oct 2026. All vulnerabilities · RSS · JSON