Memory leak in Linux kernel - CVE-2026-98492

Vulnerability identifier: #VU156792

CSH Severity: Low

CVSS v4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-98492

CWE-ID: CWE-401

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local privileged user to potentially cause a denial of service through kernel memory exhaustion.

The vulnerability exists due to missing release of allocated DMA memory in the Linux kernel macb Ethernet driver's allocation error handling when receive buffer allocation fails or an allocated transmit or receive buffer crosses a 4 GB boundary. A local privileged user can trigger affected allocation error paths to leak buffers that have not been recorded in bp->queues[0], potentially exhausting available memory and causing a denial of service.

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-aws (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux (Ubuntu package) - update to 7.0.0-42.42
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17

• https://git.kernel.org/stable/c/23d42b9a3bcd55b17d3b371544fedc708c2397e9
• https://git.kernel.org/stable/c/259e6cbb6a097da8ced544ee92a6fbde35aa1338
• https://git.kernel.org/stable/c/bda487567d0b7b15dfa876511085c0666b9efad5

• Memory leak in Linux kernel ethernet cadence driver
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more