SB2026102264 - Memory leak in Linux kernel ethernet cadence driver

Description

This security bulletin contains information about 1 vulnerability.

1) Memory leak (CVE-ID: CVE-2026-98492)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through kernel memory exhaustion.

The vulnerability exists due to missing release of allocated DMA memory in the Linux kernel macb Ethernet driver's allocation error handling when receive buffer allocation fails or an allocated transmit or receive buffer crosses a 4 GB boundary. A local privileged user can trigger affected allocation error paths to leak buffers that have not been recorded in bp->queues[0], potentially exhausting available memory and causing a denial of service.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/23d42b9a3bcd55b17d3b371544fedc708c2397e9
• https://git.kernel.org/stable/c/259e6cbb6a097da8ced544ee92a6fbde35aa1338
• https://git.kernel.org/stable/c/bda487567d0b7b15dfa876511085c0666b9efad5