{"id":"CVE-2026-53215","revision":"e684d38542034b7088bd9610b92791cd","records":[{"revision":"e684d38542034b7088bd9610b92791cd","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-53215","aliases":[],"title":"net: mvpp2: refill RX buffers before XDP or skb use","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mvpp2: refill RX buffers before XDP or skb use\n\nThe RX error path returns the current descriptor buffer to the hardware\nBM pool. That is only valid while the driver still owns the buffer.\n\nmvpp2_rx_refill() can fail after the current buffer has been handed to\nXDP or attached to an skb. In those cases mvpp2_run_xdp() may have\nrecycled, redirected, or queued the page for XDP_TX, and an skb free also\nretires the data buffer. Returning such a buffer to BM lets hardware DMA\ninto memory that is no longer owned by the RX ring.\n\nRefill the BM pool before handing the current buffer to XDP or to the\nskb. If the allocation fails there, drop the packet and return the\nstill-owned current buffer to BM, preserving the pool depth. Once the\nrefill succeeds, later local drops retire/free the current buffer instead\nof returning it to BM.","state":0,"publishedAt":"2026-06-25T08:39:18.875+00:00","modifiedAt":"2026-10-19T19:57:29.177+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"07dd0a7aae7f72af7cec18909581c2bb570edddc\",\n                            \"lessThan\": \"a88b3293b556f4d8fba11db9a8061a6b0d3b69e6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"07dd0a7aae7f72af7cec18909581c2bb570edddc\",\n                            \"lessThan\": \"a03cdcedb2cbcc42551dc3e4746929e93c5352d5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"07dd0a7aae7f72af7cec18909581c2bb570edddc\",\n                            \"lessThan\": \"580f92f27cb8724bcc4be98ee89890eab524a2ae\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"07dd0a7aae7f72af7cec18909581c2bb570edddc\",\n                            \"lessThan\": \"d0c8c4fbd22d260fe28530260656c5fb3c20ce84\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"07dd0a7aae7f72af7cec18909581c2bb570edddc\",\n                            \"lessThan\": \"8a2126c5afe89f8ceeb60a3afb9f075b736194cd\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"07dd0a7aae7f72af7cec18909581c2bb570edddc\",\n                            \"lessThan\": \"02e1b5c4d3b4c658b72c145427cded1bba613fc1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"07dd0a7aae7f72af7cec18909581c2bb570edddc\",\n                            \"lessThan\": \"5e8e2a9624df72fca7c736b2966b2cbf6c9c3ff6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"95a936364f2685e9e040c6b179b553604d96de22\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"fba2cf348d9eb50b2049a73cc09313dab6d293f1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5.7.15\",\n                            \"lessThan\": \"5.8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.8.2\",\n                            \"lessThan\": \"5.9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.9\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.9\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.210\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.176\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.143\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.94\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.36\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0.13\",\n                            \"lessThanOrEqual\": \"7.0.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://git.kernel.org/stable/c/a88b3293b556f4d8fba11db9a8061a6b0d3b69e6","https://git.kernel.org/stable/c/a03cdcedb2cbcc42551dc3e4746929e93c5352d5","https://git.kernel.org/stable/c/580f92f27cb8724bcc4be98ee89890eab524a2ae","https://git.kernel.org/stable/c/d0c8c4fbd22d260fe28530260656c5fb3c20ce84","https://git.kernel.org/stable/c/8a2126c5afe89f8ceeb60a3afb9f075b736194cd","https://git.kernel.org/stable/c/02e1b5c4d3b4c658b72c145427cded1bba613fc1","https://git.kernel.org/stable/c/5e8e2a9624df72fca7c736b2966b2cbf6c9c3ff6"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-53215","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-53215","identifiers":["CVE-2026-53215"]},"retained":false,"historicalAffected":[]}],"coverage":[]}