https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 09 Nov 2026 18:43:57 +0000 https://db.gcve.eu/vuln/cve-2026-99057 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>xen/netfront: don&#39;t leak the skb when xennet_fill_frags() fails</p> <p>When a response chain has more slots than fit in the skb&#39;s frags, xennet_fill_frags() returns an error and xennet_poll() jumps to its error path. That path moves what&#39;s left on tmpq to errq to be freed, but the skb being filled was already dequeued from tmpq, so it&#39;s never freed. Each chain that overflows leaks the skb and the pages attached to it as frags, and the backend decides how many slots it sends.</p> <p>Put the skb back on tmpq before taking the error path, like the xennet_set_skb_gso() failure just above it does.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>xen/netfront: don&#39;t leak the skb when xennet_fill_frags() fails</p> <p>When a response chain has more slots than fit in the skb&#39;s frags, xennet_fill_frags() returns an error and xennet_poll() jumps to its error path. That path moves what&#39;s left on tmpq to errq to be freed, but the skb being filled was already dequeued from tmpq, so it&#39;s never freed. Each chain that overflows leaks the skb and the pages attached to it as frags, and the backend decides how many slots it sends.</p> <p>Put the skb back on tmpq before taking the error path, like the xennet_set_skb_gso() failure just above it does.</p> https://db.gcve.eu/vuln/cve-2026-99057