- —Not scoredno CVSS score yet
- 0.17%Exploitation in 30 daysEPSS · top 94% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop In the dmaengine path the driver pre-submits RX buffers and holds in-flight TX buffers whose SKBs are DMA-mapped by the driver and freed only in the completion callbacks. On ndo_stop() dmaengine_terminate_sync() aborts these descriptors without running their callbacks, and the driver then frees only the ring shells, leaking every SKB still owned by the engine and its DMA mapping on each ifdown. With 128 RX buffers pre-posted per channel, the mapping leak can eventually exhaust a limited IOMMU aperture. Clear the slot's skb in the TX and RX callbacks so a non-NULL skb marks a slot that still owns a live, DMA-mapped buffer, and on stop unmap and free every such buffer. axienet_dma_rx_cb() runs from the DMA tasklet and re-arms the RX ring on each completion, so it can race axienet_stop(): a completion may submit a fresh buffer after dmaengine_terminate_sync() has returned, leaving the channel armed with a buffer the teardown then frees while the engine may still write into it (dma_release_channel() does not stop it either). Add a lock that axienet_dma_rx_cb() holds across the @stopping check and the resubmit, and axienet_stop() holds to set @stopping before terminating. Once @stopping is set no callback can arm a new buffer, and any armed just before is aborted by the terminate, so teardown only frees buffers the engine no longer owns.
Timeline
ID reserved
By Linux
- 28 days later
· 28 days later
Published
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.17% · top 94% of all CVEs (11 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected 6a91b846af85a24241decd686269e8e038eb13d1 – < 079396129da5e7cb40ca0920aa1b9525bef6097c
- affected 6a91b846af85a24241decd686269e8e038eb13d1 – < eececf7c3a679d9c08175ad6bacbc8c31848f5af
- affected 6a91b846af85a24241decd686269e8e038eb13d1 – < 5e5cf3ad7c099ff86ea9e422cddb25a2e5317b58
- affected 6a91b846af85a24241decd686269e8e038eb13d1 – < bcf2573a68a808a5b54cadafa72b6672e662c2bf
- affected 6.8
- unaffected < 6.8
- unaffected 6.12.114 – ≤ 6.12.*
- unaffected 6.18.58 – ≤ 6.18.*
- unaffected 7.2.11 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
4
- https://git.kernel.org/stable/c/079396129da5e7cb40ca0920aa1b9525bef6097c (opens in a new tab)
- https://git.kernel.org/stable/c/eececf7c3a679d9c08175ad6bacbc8c31848f5af (opens in a new tab)
- https://git.kernel.org/stable/c/5e5cf3ad7c099ff86ea9e422cddb25a2e5317b58 (opens in a new tab)
- https://git.kernel.org/stable/c/bcf2573a68a808a5b54cadafa72b6672e662c2bf (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-108823 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-99028)Record last updated .