Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Linux kernel fix prevents duplicate buffer release

CVE-2026-99078 · published 8 days ago
Summary

The Linux kernel’s network driver could try to free the same memory buffer twice when a certain high‑speed networking feature runs out of memory. This could cause system instability. The update corrects the logic so the release is only attempted once; apply the latest kernel patches to avoid the issue.

What to do
  • Update debian linux to version 6.12.113-1.
  • Update debian linux to version 7.2.11-1.
  • Update linux kernel to version 7.2.11.
  • Update bellsoft linux-lts to version 6.18.58-r0.
  • Update bellsoft linux-lts to version 6.12.115-r0.
  • Update linux linux to version f3a52e2ec2788a7f6b64137985c087188a54ad4f or later.
Affected software
Ecosystem VendorProductAffected versions
Debian:13 debian linux < 6.12.113-1
Fix: upgrade to 6.12.113-1
Debian:14 debian linux < 7.2.11-1
Fix: upgrade to 7.2.11-1
Linux linux kernel >= 6.19.0, < 7.2.11
Fix: upgrade to 7.2.11
– linux linux < f3a52e2ec2788a7f6b64137985c087188a54ad4f
6.4
Ubuntu:Pro:14.04:LTS canonical linux All versions
Ubuntu:Pro:14.04:LTS canonical linux-aws All versions
Ubuntu:Pro:14.04:LTS canonical linux-azure All versions
Ubuntu:Pro:14.04:LTS canonical linux-lts-xenial All versions
Ubuntu:Pro:16.04:LTS canonical linux-aws-hwe All versions
Ubuntu:Pro:16.04:LTS canonical linux-gcp All versions
Ubuntu:Pro:16.04:LTS canonical linux-hwe All versions
Ubuntu:16.04:LTS canonical linux-hwe-edge All versions
Ubuntu:Pro:16.04:LTS canonical linux-kvm All versions
Ubuntu:Pro:16.04:LTS canonical linux-oracle All versions
Ubuntu:Pro:FIPS-updates:16.04:LTS canonical linux-fips All versions
Ubuntu:18.04:LTS canonical linux-aws-5.0 All versions
Ubuntu:18.04:LTS canonical linux-aws-5.3 All versions
Ubuntu:Pro:18.04:LTS canonical linux-aws-5.4 All versions
Ubuntu:Pro:18.04:LTS canonical linux-azure-4.15 All versions
Ubuntu:18.04:LTS canonical linux-azure-5.3 All versions
Ubuntu:Pro:18.04:LTS canonical linux-azure-5.4 All versions
Ubuntu:18.04:LTS canonical linux-azure-edge All versions
Ubuntu:Pro:18.04:LTS canonical linux-gcp-4.15 All versions
Ubuntu:18.04:LTS canonical linux-gcp-5.3 All versions
Ubuntu:Pro:18.04:LTS canonical linux-gcp-5.4 All versions
Ubuntu:18.04:LTS canonical linux-gke-4.15 All versions
Ubuntu:18.04:LTS canonical linux-gke-5.4 All versions
Ubuntu:18.04:LTS canonical linux-gkeop-5.4 All versions
Ubuntu:Pro:18.04:LTS canonical linux-hwe-5.4 All versions
Ubuntu:Pro:18.04:LTS canonical linux-ibm-5.4 All versions
Ubuntu:18.04:LTS canonical linux-oem All versions
Ubuntu:18.04:LTS canonical linux-oracle-5.0 All versions
Ubuntu:18.04:LTS canonical linux-oracle-5.3 All versions
Ubuntu:Pro:18.04:LTS canonical linux-oracle-5.4 All versions
Ubuntu:Pro:18.04:LTS canonical linux-raspi-5.4 All versions
Ubuntu:Pro:FIPS-updates:18.04:LTS canonical linux-aws-fips All versions
Ubuntu:Pro:FIPS-updates:18.04:LTS canonical linux-azure-fips All versions
Ubuntu:Pro:FIPS-updates:18.04:LTS canonical linux-gcp-fips All versions
Ubuntu:20.04:LTS canonical linux-aws-5.11 All versions
Ubuntu:20.04:LTS canonical linux-aws-5.13 All versions
Ubuntu:Pro:20.04:LTS canonical linux-aws-5.15 All versions
Ubuntu:20.04:LTS canonical linux-aws-5.8 All versions
Ubuntu:20.04:LTS canonical linux-azure-5.11 All versions
Ubuntu:20.04:LTS canonical linux-azure-5.13 All versions
Ubuntu:Pro:20.04:LTS canonical linux-azure-5.15 All versions
Ubuntu:20.04:LTS canonical linux-azure-5.8 All versions
Ubuntu:20.04:LTS canonical linux-azure-fde All versions
Ubuntu:Pro:20.04:LTS canonical linux-azure-fde-5.15 All versions
Ubuntu:Pro:20.04:LTS canonical linux-bluefield All versions
Ubuntu:20.04:LTS canonical linux-gcp-5.11 All versions
Showing 50 of 175. Show the rest
Ecosystem VendorProductAffected versions
Ubuntu:20.04:LTS canonical linux-gcp-5.13 All versions
Ubuntu:Pro:20.04:LTS canonical linux-gcp-5.15 All versions
Ubuntu:20.04:LTS canonical linux-gcp-5.8 All versions
Ubuntu:20.04:LTS canonical linux-gke All versions
Ubuntu:20.04:LTS canonical linux-gke-5.15 All versions
Ubuntu:20.04:LTS canonical linux-gkeop All versions
Ubuntu:20.04:LTS canonical linux-gkeop-5.15 All versions
Ubuntu:20.04:LTS canonical linux-hwe-5.11 All versions
Ubuntu:20.04:LTS canonical linux-hwe-5.13 All versions
Ubuntu:Pro:20.04:LTS canonical linux-hwe-5.15 All versions
Ubuntu:20.04:LTS canonical linux-hwe-5.8 All versions
Ubuntu:Pro:20.04:LTS canonical linux-ibm All versions
Ubuntu:Pro:20.04:LTS canonical linux-ibm-5.15 All versions
Ubuntu:20.04:LTS canonical linux-intel-5.13 All versions
Ubuntu:Pro:20.04:LTS canonical linux-intel-iotg-5.15 All versions
Ubuntu:Pro:20.04:LTS canonical linux-iot All versions
Ubuntu:Pro:20.04:LTS canonical linux-lowlatency-hwe-5.15 All versions
Ubuntu:Pro:20.04:LTS canonical linux-nvidia-tegra-5.15 All versions
Ubuntu:20.04:LTS canonical linux-oem-5.10 All versions
Ubuntu:20.04:LTS canonical linux-oem-5.13 All versions
Ubuntu:20.04:LTS canonical linux-oem-5.14 All versions
Ubuntu:20.04:LTS canonical linux-oem-5.6 All versions
Ubuntu:20.04:LTS canonical linux-oracle-5.11 All versions
Ubuntu:20.04:LTS canonical linux-oracle-5.13 All versions
Ubuntu:Pro:20.04:LTS canonical linux-oracle-5.15 All versions
Ubuntu:20.04:LTS canonical linux-oracle-5.8 All versions
Ubuntu:Pro:20.04:LTS canonical linux-raspi All versions
Ubuntu:20.04:LTS canonical linux-raspi2 All versions
Ubuntu:20.04:LTS canonical linux-riscv All versions
Ubuntu:20.04:LTS canonical linux-riscv-5.11 All versions
Ubuntu:Pro:20.04:LTS canonical linux-riscv-5.15 All versions
Ubuntu:20.04:LTS canonical linux-riscv-5.8 All versions
Ubuntu:Pro:20.04:LTS canonical linux-xilinx-zynqmp All versions
Ubuntu:22.04:LTS canonical linux-allwinner-5.19 All versions
Ubuntu:22.04:LTS canonical linux-aws-5.19 All versions
Ubuntu:22.04:LTS canonical linux-aws-6.2 All versions
Ubuntu:22.04:LTS canonical linux-aws-6.5 All versions
Ubuntu:22.04:LTS canonical linux-aws-6.8 All versions
Ubuntu:22.04:LTS canonical linux-azure-5.19 All versions
Ubuntu:22.04:LTS canonical linux-azure-6.2 All versions
Ubuntu:22.04:LTS canonical linux-azure-6.5 All versions
Ubuntu:22.04:LTS canonical linux-azure-6.8 All versions
Ubuntu:22.04:LTS canonical linux-azure-fde-5.19 All versions
Ubuntu:22.04:LTS canonical linux-azure-fde-6.2 All versions
Ubuntu:22.04:LTS canonical linux-azure-fde-6.8 All versions
Ubuntu:22.04:LTS canonical linux-gcp-5.19 All versions
Ubuntu:22.04:LTS canonical linux-gcp-6.2 All versions
Ubuntu:22.04:LTS canonical linux-gcp-6.5 All versions
Ubuntu:22.04:LTS canonical linux-gcp-6.8 All versions
Ubuntu:22.04:LTS canonical linux-hwe-5.19 All versions
Ubuntu:22.04:LTS canonical linux-hwe-6.2 All versions
Ubuntu:22.04:LTS canonical linux-hwe-6.5 All versions
Ubuntu:22.04:LTS canonical linux-hwe-6.8 All versions
Ubuntu:22.04:LTS canonical linux-ibm-6.8 All versions
Ubuntu:22.04:LTS canonical linux-intel-iot-realtime All versions
Ubuntu:22.04:LTS canonical linux-intel-iotg All versions
Ubuntu:22.04:LTS canonical linux-lowlatency All versions
Ubuntu:22.04:LTS canonical linux-lowlatency-hwe-5.19 All versions
Ubuntu:22.04:LTS canonical linux-lowlatency-hwe-6.2 All versions
Ubuntu:22.04:LTS canonical linux-lowlatency-hwe-6.5 All versions
Ubuntu:22.04:LTS canonical linux-lowlatency-hwe-6.8 All versions
Ubuntu:22.04:LTS canonical linux-nvidia All versions
Ubuntu:22.04:LTS canonical linux-nvidia-6.2 All versions
Ubuntu:22.04:LTS canonical linux-nvidia-6.5 All versions
Ubuntu:22.04:LTS canonical linux-nvidia-6.8 All versions
Ubuntu:22.04:LTS canonical linux-nvidia-tegra All versions
Ubuntu:22.04:LTS canonical linux-nvidia-tegra-igx All versions
Ubuntu:22.04:LTS canonical linux-oem-5.17 All versions
Ubuntu:22.04:LTS canonical linux-oem-6.0 All versions
Ubuntu:22.04:LTS canonical linux-oem-6.1 All versions
Ubuntu:22.04:LTS canonical linux-oem-6.5 All versions
Ubuntu:22.04:LTS canonical linux-oracle-6.5 All versions
Ubuntu:22.04:LTS canonical linux-oracle-6.8 All versions
Ubuntu:22.04:LTS canonical linux-realtime All versions
Ubuntu:22.04:LTS canonical linux-riscv-5.19 All versions
Ubuntu:22.04:LTS canonical linux-riscv-6.5 All versions
Ubuntu:22.04:LTS canonical linux-riscv-6.8 All versions
Ubuntu:22.04:LTS canonical linux-starfive-5.19 All versions
Ubuntu:22.04:LTS canonical linux-starfive-6.2 All versions
Ubuntu:22.04:LTS canonical linux-starfive-6.5 All versions
Ubuntu:Pro:Realtime:22.04:LTS canonical linux-realtime-6.8 All versions
Ubuntu:24.04:LTS canonical linux-aws-6.14 All versions
Ubuntu:24.04:LTS canonical linux-aws-6.17 All versions
Ubuntu:24.04:LTS canonical linux-aws-7.0 All versions
Ubuntu:24.04:LTS canonical linux-azure-6.11 All versions
Ubuntu:24.04:LTS canonical linux-azure-6.14 All versions
Ubuntu:24.04:LTS canonical linux-azure-6.17 All versions
Ubuntu:24.04:LTS canonical linux-azure-7.0 All versions
Ubuntu:24.04:LTS canonical linux-azure-fde-6.14 All versions
Ubuntu:24.04:LTS canonical linux-azure-fde-6.17 All versions
Ubuntu:24.04:LTS canonical linux-azure-fde-7.0 All versions
Ubuntu:24.04:LTS canonical linux-azure-nvidia All versions
Ubuntu:24.04:LTS canonical linux-azure-nvidia-6.14 All versions
Ubuntu:24.04:LTS canonical linux-gcp-6.11 All versions
Ubuntu:24.04:LTS canonical linux-gcp-6.14 All versions
Ubuntu:24.04:LTS canonical linux-gcp-6.17 All versions
Ubuntu:24.04:LTS canonical linux-gcp-7.0 All versions
Ubuntu:24.04:LTS canonical linux-hwe-6.11 All versions
Ubuntu:24.04:LTS canonical linux-hwe-6.14 All versions
Ubuntu:24.04:LTS canonical linux-hwe-6.17 All versions
Ubuntu:24.04:LTS canonical linux-hwe-7.0 All versions
Ubuntu:24.04:LTS canonical linux-lowlatency-hwe-6.11 All versions
Ubuntu:24.04:LTS canonical linux-nvidia-6.11 All versions
Ubuntu:24.04:LTS canonical linux-nvidia-6.17 All versions
Ubuntu:24.04:LTS canonical linux-nvidia-7.0 All versions
Ubuntu:24.04:LTS canonical linux-nvidia-lowlatency All versions
Ubuntu:24.04:LTS canonical linux-oem-6.11 All versions
Ubuntu:24.04:LTS canonical linux-oem-6.14 All versions
Ubuntu:24.04:LTS canonical linux-oem-6.17 All versions
Ubuntu:24.04:LTS canonical linux-oem-6.8 All versions
Ubuntu:24.04:LTS canonical linux-oracle-6.14 All versions
Ubuntu:24.04:LTS canonical linux-oracle-6.17 All versions
Ubuntu:24.04:LTS canonical linux-oracle-7.0 All versions
Ubuntu:24.04:LTS canonical linux-raspi-realtime All versions
Ubuntu:24.04:LTS canonical linux-riscv-6.14 All versions
Ubuntu:24.04:LTS canonical linux-riscv-6.17 All versions
Ubuntu:24.04:LTS canonical linux-riscv-7.0 All versions
Ubuntu:24.04:LTS canonical linux-vmware All versions
Ubuntu:24.04:LTS canonical linux-xilinx All versions
Ubuntu:Pro:Realtime:24.04:LTS canonical linux-realtime-6.14 All versions
Ubuntu:Pro:Realtime:24.04:LTS canonical linux-realtime-6.17 All versions
Ubuntu:26.04:LTS canonical linux-nvidia-bos All versions
Ubuntu:26.04:LTS canonical linux-oem-7.0 All versions
Alpaquita:25 bellsoft linux-lts >= 6.12.112-r0
>= 6.12.112-r0, < 6.12.115-r0
Fix: upgrade to 6.12.115-r0
Alpaquita:stream bellsoft linux-lts >= 6.18.55-r0, < 6.18.58-r0
Fix: upgrade to 6.18.58-r0
Original advisory text
BELL-CVE-2026-99078
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry With AF_XDP on a striding RQ, mlx5e defers releasing XSK buffers until an MPWQE is refilled. If XSK allocation then returns -ENOMEM, actual_wq_head is not advanced and a later NAPI poll retries the same WQE. mlx5e_free_rx_mpwqe() leaves each released slot marked as releasable. On retry it can therefore call xsk_buff_free() again through stale pointers after the frames have returned to the XSK pool and been reallocated. Set all skip_release_bitmap bits in the common error path of mlx5e_xsk_alloc_rx_mpwqe(). This matches mlx5e_alloc_rx_mpwqe(). A successful allocation already clears the bitmap after replacing every buffer, so retries become idempotent without changing the success path. Fault injection forced three consecutive failures for one selected MPWQE. Both an early allocation failure and a partial 8-of-16-buffer unwind released the original 16 XSK buffers only once. Each error left a full bitmap, the following NAPI retry skipped the release, and a later successful allocation cleared it. A 20-second AF_XDP zero-copy pressure run exercised 1,575,262 buffer allocation failures without invalid descriptors, WQE errors, or kernel warnings.
References
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Timeline
Published28 Oct 2026
Updated4 Nov 2026
First seen23 Oct 2026
Sources
CVE-2026-99078 · NVD
DEBIAN-CVE-2026-99078 · OSV
CVE-2026-99078 · OSV
CVE-2026-99078 · MITRE
UBUNTU-CVE-2026-99078 · OSV
BELL-CVE-2026-99078 · OSV
Track software like this
Free during beta