CVE-2026-99057 - Vulnerability Details

- xen/netfront: don't leak the skb when xennet_fill_frags() fails

Description

In the Linux kernel, the following vulnerability has been resolved:

xen/netfront: don't leak the skb when xennet_fill_frags() fails

When a response chain has more slots than fit in the skb's frags,
xennet_fill_frags() returns an error and xennet_poll() jumps to its
error path. That path moves what's left on tmpq to errq to be freed,
but the skb being filled was already dequeued from tmpq, so it's never
freed. Each chain that overflows leaks the skb and the pages attached
to it as frags, and the backend decides how many slots it sends.

Put the skb back on tmpq before taking the error path, like the
xennet_set_skb_gso() failure just above it does.

Published: 2026-10-23

Score: 2.3 Low

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a memory leak in the Xen netfront driver of the Linux kernel. When xennet_fill_frags() fails due to an oversized response chain, the partially constructed socket buffer and its page fragments are not freed, leaking kernel memory. The leak accumulates with repeated failures, potentially exhausting memory and causing a denial of service. The weakness is identified as CWE-772.

Affected Systems

The Linux kernel includes the Xen netfront networking component. Any distribution that ships a kernel containing this vulnerable code may be affected. Version details are not provided in the CVE data, so affected kernel releases must be verified against the referenced commit history.

Risk and Exploitability

The CVSS score is 2.3, indicating low severity. The EPSS score is <1%, suggesting a low probability of exploitation. The issue is not listed in the CISA KEV catalog, implying no known live exploitation. The vulnerability requires triggering the Xen netfront driver with a malformed response, implying the attacker would need network traffic processed by the driver. No remote code execution or privilege escalation is possible; the impact is confined to resource exhaustion.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c`	affected	< 6e6bd1051daabc327233c3ca3d00613fc6783c8e
`ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c`	affected	< 0cf0a25a639c535146c5eb4480d256995721aed6
`ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c`	affected	< 53a131eb2a998c77e2851401b32b712d6c6e8487
`ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c`	affected	< 5051df031144753d3e18862514969146b601d089
`ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c`	affected	< 99011a11c97340ef7290df7dc199305c73fab2f2
`ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c`	affected	< 086944c1c2cbb683543bc3ff08637847b03c8009
`ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c`	affected	< 84e3ea6502b5f14ce8d499d0b6e0e38386274cf0
`ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c`	affected	< 93ccaf1c26e2133396173b76a071e59024daa622
`bd1468048aa3e2af865da92990539946d4483989`	affected	—
`29a6193c0d74390c004808441061ac1812cf6f51`	affected	—
`7eced4478f4ec6ff0a603ddfd6e24a5d3831fca7`	affected	—
`b73a161e9beff24bf1803ba393dff95a255268f9`	affected	—
`4.4.159`	affected	< 4.5
`4.9.130`	affected	< 4.10
`4.14.73`	affected	< 4.15
`4.18.11`	affected	< 4.19

Linux

affected

Version	Status	Constraints
`4.19`	affected	—
`0`	unaffected	< 4.19
`5.10.273`	unaffected	≤ 5.10.*
`5.15.224`	unaffected	≤ 5.15.*
`6.1.191`	unaffected	≤ 6.1.*
`6.6.160`	unaffected	≤ 6.6.*
`6.12.113`	unaffected	≤ 6.12.*
`6.18.57`	unaffected	≤ 6.18.*
`7.2.11`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

100%

Version	Status	Scheme	Platform
`[ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c,5051df031144753d3e18862514969146b601d089)`	affected	code_commit	—
`[ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c,99011a11c97340ef7290df7dc199305c73fab2f2)`	affected	code_commit	—
`[ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c,086944c1c2cbb683543bc3ff08637847b03c8009)`	affected	code_commit	—
`[ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c,84e3ea6502b5f14ce8d499d0b6e0e38386274cf0)`	affected	code_commit	—
`[ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c,93ccaf1c26e2133396173b76a071e59024daa622)`	affected	code_commit	—
`bd1468048aa3e2af865da92990539946d4483989`	affected	code_commit	—
`29a6193c0d74390c004808441061ac1812cf6f51`	affected	code_commit	—
`7eced4478f4ec6ff0a603ddfd6e24a5d3831fca7`	affected	code_commit	—
`b73a161e9beff24bf1803ba393dff95a255268f9`	affected	code_commit	—
`[4.4.159,4.5)`	affected	generic	—
`[4.9.130,4.10)`	affected	generic	—
`[4.14.73,4.15)`	affected	generic	—
`[4.18.11,4.19)`	affected	generic	—

Linux

100%

Version	Status	Scheme	Platform
`4.19`	affected	generic	—
`[0,4.19)`	unaffected	generic	—
`[6.6.160,6.6.*]`	unaffected	generic	—
`[6.12.113,6.12.*]`	unaffected	generic	—
`[6.18.57,6.18.*]`	unaffected	generic	—
`[7.2.11,7.2.*]`	unaffected	generic	—
`[7.3,*]`	unaffected	generic	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c,5051df031144753d3e18862514969146b601d089)`	affected	code_commit	—
`[ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c,99011a11c97340ef7290df7dc199305c73fab2f2)`	affected	code_commit	—
`[ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c,086944c1c2cbb683543bc3ff08637847b03c8009)`	affected	code_commit	—
`[ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c,84e3ea6502b5f14ce8d499d0b6e0e38386274cf0)`	affected	code_commit	—
`[ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c,93ccaf1c26e2133396173b76a071e59024daa622)`	affected	code_commit	—
`bd1468048aa3e2af865da92990539946d4483989`	affected	code_commit	—
`29a6193c0d74390c004808441061ac1812cf6f51`	affected	code_commit	—
`7eced4478f4ec6ff0a603ddfd6e24a5d3831fca7`	affected	code_commit	—
`b73a161e9beff24bf1803ba393dff95a255268f9`	affected	code_commit	—
`[4.4.159,4.5)`	affected	generic	—
`[4.9.130,4.10)`	affected	generic	—
`[4.14.73,4.15)`	affected	generic	—
`[4.18.11,4.19)`	affected	generic	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`4.19`	affected	generic	—
`[0,4.19)`	unaffected	generic	—
`[6.6.160,6.6.*]`	unaffected	generic	—
`[6.12.113,6.12.*]`	unaffected	generic	—
`[6.18.57,6.18.*]`	unaffected	generic	—
`[7.2.11,7.2.*]`	unaffected	generic	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a Linux kernel update that includes the Xen netfront patch referenced in the CVE documentation
If a kernel update cannot be applied immediately, disable the Xen netfront driver or block traffic so that malformed responses do not reach the driver
Monitor kernel memory usage for unexplained growth and configure alerts for high kernel memory consumption

Generated by OpenCVE AI on October 27, 2026 at 14:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-9018-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9018-2	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00185.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99057.mbox
https://git.kernel.org/stable/c/086944c1c2cbb683543bc3ff08637847b03c8009
https://git.kernel.org/stable/c/0cf0a25a639c535146c5eb4480d256995721aed6
https://git.kernel.org/stable/c/5051df031144753d3e18862514969146b601d089
https://git.kernel.org/stable/c/53a131eb2a998c77e2851401b32b712d6c6e8487
https://git.kernel.org/stable/c/6e6bd1051daabc327233c3ca3d00613fc6783c8e
https://git.kernel.org/stable/c/84e3ea6502b5f14ce8d499d0b6e0e38386274cf0
https://git.kernel.org/stable/c/93ccaf1c26e2133396173b76a071e59024daa622
https://git.kernel.org/stable/c/99011a11c97340ef7290df7dc199305c73fab2f2
https://nvd.nist.gov/vuln/detail/CVE-2026-99057
https://www.cve.org/CVERecord?id=CVE-2026-99057

History

Fri, 30 Oct 2026 13:00:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/0cf0a25a639c535146c5eb4480d256995721aed6 https://git.kernel.org/stable/c/53a131eb2a998c77e2851401b32b712d6c6e8487 https://git.kernel.org/stable/c/6e6bd1051daabc327233c3ca3d00613fc6783c8e

Tue, 27 Oct 2026 12:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-772
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99057.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-99057 https://www.cve.org/CVERecord?id=CVE-2026-99057
Metrics	threat_severity `None`	cvssV3_1 `{'score': 2.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L'}` threat_severity `Low`

Fri, 23 Oct 2026 22:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Fri, 23 Oct 2026 12:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: xen/netfront: don't leak the skb when xennet_fill_frags() fails When a response chain has more slots than fit in the skb's frags, xennet_fill_frags() returns an error and xennet_poll() jumps to its error path. That path moves what's left on tmpq to errq to be freed, but the skb being filled was already dequeued from tmpq, so it's never freed. Each chain that overflows leaks the skb and the pages attached to it as frags, and the backend decides how many slots it sends. Put the skb back on tmpq before taking the error path, like the xennet_set_skb_gso() failure just above it does.
Title		xen/netfront: don't leak the skb when xennet_fill_frags() fails
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/086944c1c2cbb683543bc3ff08637847b03c8009 https://git.kernel.org/stable/c/5051df031144753d3e18862514969146b601d089 https://git.kernel.org/stable/c/84e3ea6502b5f14ce8d499d0b6e0e38386274cf0 https://git.kernel.org/stable/c/93ccaf1c26e2133396173b76a071e59024daa622 https://git.kernel.org/stable/c/99011a11c97340ef7290df7dc199305c73fab2f2

Subscriptions

Linux Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-23T12:22:44.683Z

Updated: 2026-10-30T12:41:23.425Z

Reserved: 2026-09-25T10:25:14.388Z

Link: CVE-2026-99057

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-23T13:17:29.373

Modified: 2026-10-30T13:21:42.453

Link: CVE-2026-99057

Redhat

Severity : Low

Publid Date: 2026-10-23T00:00:00Z

Links: CVE-2026-99057 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-27T14:15:03Z

Weaknesses

CWE-772
Missing Release of Resource after Effective Lifetime

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object