CVE-2026-99046 - Vulnerability Details - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak on error descriptor When the error bit is set in the RX completion descriptor, the buf_state and its attached buffer should be freed. In the case of AF_XDP ZC, the XSK buffer was not freed, leading to a leak. This issue was caught by LLM.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Linux	Linux Linux Kernel

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/06656aaa7e43ae62b673c2244d27099b8b94a70d
https://git.kernel.org/stable/c/889f763874855c575429f75946132a53c573aa14
https://git.kernel.org/stable/c/9fed6a8ab8a5bacba2c709cb19d2dd6d2fa9112e

History

Fri, 23 Oct 2026 21:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Fri, 23 Oct 2026 16:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-401

Fri, 23 Oct 2026 12:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak on error descriptor When the error bit is set in the RX completion descriptor, the buf_state and its attached buffer should be freed. In the case of AF_XDP ZC, the XSK buffer was not freed, leading to a leak. This issue was caught by LLM.
Title		gve: fix XSK buffer leak on error descriptor
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/06656aaa7e43ae62b673c2244d27099b8b94a70d https://git.kernel.org/stable/c/889f763874855c575429f75946132a53c573aa14 https://git.kernel.org/stable/c/9fed6a8ab8a5bacba2c709cb19d2dd6d2fa9112e

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-23T12:22:10.460Z

Updated: 2026-10-23T12:22:10.460Z

Reserved: 2026-09-25T10:25:14.388Z

Link: CVE-2026-99046

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-23T13:17:28.073

Modified: 2026-10-23T13:17:28.073

Link: CVE-2026-99046

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99046", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.388Z", "datePublished": "2026-10-23T12:22:10.460Z", "dateUpdated": "2026-10-23T12:22:10.460Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-23T12:22:10.460Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngve: fix XSK buffer leak on error descriptor\n\nWhen the error bit is set in the RX completion descriptor, the buf_state\nand its attached buffer should be freed. In the case of AF_XDP ZC, the\nXSK buffer was not freed, leading to a leak.\n\nThis issue was caught by LLM."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/google/gve/gve_rx_dqo.c"], "versions": [{"version": "c1fffc5d66a7147d557736c2341a511e0896d9ff", "lessThan": "06656aaa7e43ae62b673c2244d27099b8b94a70d", "status": "affected", "versionType": "git"}, {"version": "c1fffc5d66a7147d557736c2341a511e0896d9ff", "lessThan": "889f763874855c575429f75946132a53c573aa14", "status": "affected", "versionType": "git"}, {"version": "c1fffc5d66a7147d557736c2341a511e0896d9ff", "lessThan": "9fed6a8ab8a5bacba2c709cb19d2dd6d2fa9112e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/google/gve/gve_rx_dqo.c"], "versions": [{"version": "6.17", "status": "affected"}, {"version": "0", "lessThan": "6.17", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.11", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "7.2.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/06656aaa7e43ae62b673c2244d27099b8b94a70d"}, {"url": "https://git.kernel.org/stable/c/889f763874855c575429f75946132a53c573aa14"}, {"url": "https://git.kernel.org/stable/c/9fed6a8ab8a5bacba2c709cb19d2dd6d2fa9112e"}], "title": "gve: fix XSK buffer leak on error descriptor", "x_generator": {"engine": "bippy-1.2.0"}}}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/google/gve/gve_rx_dqo.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "06656aaa7e43ae62b673c2244d27099b8b94a70d", "status": "affected", "version": "c1fffc5d66a7147d557736c2341a511e0896d9ff", "versionType": "git"}, {"lessThan": "889f763874855c575429f75946132a53c573aa14", "status": "affected", "version": "c1fffc5d66a7147d557736c2341a511e0896d9ff", "versionType": "git"}, {"lessThan": "9fed6a8ab8a5bacba2c709cb19d2dd6d2fa9112e", "status": "affected", "version": "c1fffc5d66a7147d557736c2341a511e0896d9ff", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/google/gve/gve_rx_dqo.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.17"}, {"lessThan": "6.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngve: fix XSK buffer leak on error descriptor\n\nWhen the error bit is set in the RX completion descriptor, the buf_state\nand its attached buffer should be freed. In the case of AF_XDP ZC, the\nXSK buffer was not freed, leading to a leak.\n\nThis issue was caught by LLM."}], "id": "CVE-2026-99046", "lastModified": "2026-10-23T13:17:28.073", "metrics": {}, "published": "2026-10-23T13:17:28.073", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/06656aaa7e43ae62b673c2244d27099b8b94a70d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/889f763874855c575429f75946132a53c573aa14"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9fed6a8ab8a5bacba2c709cb19d2dd6d2fa9112e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}