Not yet scoredPublished Oct 23, 2026

CVE-2026-99057xen/netfront: don't leak the skb when xennet_fill_frags() fails

Updated under an hour ago (Oct 28, 2026, 5:30 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: xen/netfront: don't leak the skb when xennet_fill_frags() fails When a response chain has more slots than fit in the skb's frags, xennet_fill_frags() returns an error and xennet_poll() jumps to its error path. That path moves what's left on tmpq to errq to be freed, but the skb being filled was already dequeued from tmpq, so it's never freed. Each chain that overflows leaks the skb and the pages attached to it as frags, and the backend decides how many slots it sends. Put the skb back on tmpq before taking the error path, like the xennet_set_skb_gso() failure just above it does.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 23, 2026
First seen by InfoSec Signals: Oct 23, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c before 5051df031144753d3e18862514969146b601d089; from ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c before 99011a11c97340ef7290df7dc199305c73fab2f2; from ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c before 086944c1c2cbb683543bc3ff08637847b03c8009; from ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c before 84e3ea6502b5f14ce8d499d0b6e0e38386274cf0; from ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c before 93ccaf1c26e2133396173b76a071e59024daa622; bd1468048aa3e2af865da92990539946d4483989; 29a6193c0d74390c004808441061ac1812cf6f51; 7eced4478f4ec6ff0a603ddfd6e24a5d3831fca7; and 5 more ranges	CNA record

References

References

https://git.kernel.org/stable/c/5051df031144753d3e18862514969146b601d089
https://git.kernel.org/stable/c/99011a11c97340ef7290df7dc199305c73fab2f2
https://git.kernel.org/stable/c/086944c1c2cbb683543bc3ff08637847b03c8009
https://git.kernel.org/stable/c/84e3ea6502b5f14ce8d499d0b6e0e38386274cf0
https://git.kernel.org/stable/c/93ccaf1c26e2133396173b76a071e59024daa622

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.