{"id":"CVE-2026-99057","revision":"c60082a07ba2416d8aa7f9c41dc07e94","records":[{"revision":"c60082a07ba2416d8aa7f9c41dc07e94","observedAt":"2026-10-23T16:01:20.601+00:00","statement":{"source":"cve-program","id":"CVE-2026-99057","aliases":[],"title":"xen/netfront: don't leak the skb when xennet_fill_frags() fails","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nxen/netfront: don't leak the skb when xennet_fill_frags() fails\n\nWhen a response chain has more slots than fit in the skb's frags,\nxennet_fill_frags() returns an error and xennet_poll() jumps to its\nerror path.  That path moves what's left on tmpq to errq to be freed,\nbut the skb being filled was already dequeued from tmpq, so it's never\nfreed.  Each chain that overflows leaks the skb and the pages attached\nto it as frags, and the backend decides how many slots it sends.\n\nPut the skb back on tmpq before taking the error path, like the\nxennet_set_skb_gso() failure just above it does.","state":0,"publishedAt":"2026-10-23T12:22:44.683+00:00","modifiedAt":"2026-10-23T12:22:44.683+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/xen-netfront.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c\",\n                            \"lessThan\": \"5051df031144753d3e18862514969146b601d089\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c\",\n                            \"lessThan\": \"99011a11c97340ef7290df7dc199305c73fab2f2\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c\",\n                            \"lessThan\": \"086944c1c2cbb683543bc3ff08637847b03c8009\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c\",\n                            \"lessThan\": \"84e3ea6502b5f14ce8d499d0b6e0e38386274cf0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c\",\n                            \"lessThan\": \"93ccaf1c26e2133396173b76a071e59024daa622\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"bd1468048aa3e2af865da92990539946d4483989\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"29a6193c0d74390c004808441061ac1812cf6f51\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7eced4478f4ec6ff0a603ddfd6e24a5d3831fca7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b73a161e9beff24bf1803ba393dff95a255268f9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4.4.159\",\n                            \"lessThan\": \"4.5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"4.9.130\",\n                            \"lessThan\": \"4.10\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"4.14.73\",\n                            \"lessThan\": \"4.15\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"4.18.11\",\n                            \"lessThan\": \"4.19\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/xen-netfront.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.19\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.19\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.160\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.113\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.57\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.11\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/5051df031144753d3e18862514969146b601d089","https://git.kernel.org/stable/c/99011a11c97340ef7290df7dc199305c73fab2f2","https://git.kernel.org/stable/c/086944c1c2cbb683543bc3ff08637847b03c8009","https://git.kernel.org/stable/c/84e3ea6502b5f14ce8d499d0b6e0e38386274cf0","https://git.kernel.org/stable/c/93ccaf1c26e2133396173b76a071e59024daa622"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-99057","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-99057","identifiers":["CVE-2026-99057"]},"retained":false,"historicalAffected":[]}],"coverage":[]}