Memory leak in Linux kernel - CVE-2026-99028
Published: October 23, 2026
Vulnerability identifier: #VU157481
CSH Severity: Low
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-99028
CWE-ID: CWE-401
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local privileged user to cause a denial of service by exhausting memory or DMA mapping resources.
The vulnerability exists due to missing release of socket buffers and DMA mappings in the Xilinx AXI Ethernet driver's dmaengine path when stopping a network interface with outstanding DMA descriptors. A local privileged user can repeatedly bring an interface down, if permitted, to accumulate unreleased buffers and mappings, potentially exhausting a limited IOMMU aperture and causing a denial of service.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-99028
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.115-2
linux (Debian package) - update to 6.12.115-2