SB20261023139 - Memory leak in Linux kernel ethernet xilinx driver

Description

This security bulletin contains information about 1 vulnerability.

1) Memory leak (CVE-ID: CVE-2026-99028)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by exhausting memory or DMA mapping resources.

The vulnerability exists due to missing release of socket buffers and DMA mappings in the Xilinx AXI Ethernet driver's dmaengine path when stopping a network interface with outstanding DMA descriptors. A local privileged user can repeatedly bring an interface down, if permitted, to accumulate unreleased buffers and mappings, potentially exhausting a limited IOMMU aperture and causing a denial of service.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/079396129da5e7cb40ca0920aa1b9525bef6097c
• https://git.kernel.org/stable/c/5e5cf3ad7c099ff86ea9e422cddb25a2e5317b58
• https://git.kernel.org/stable/c/bcf2573a68a808a5b54cadafa72b6672e662c2bf
• https://git.kernel.org/stable/c/eececf7c3a679d9c08175ad6bacbc8c31848f5af