CVE-2026-23453 (GCVE-0-2026-23453)

Vulnerability from cvelistv5 – Published: 2026-04-03 15:15 – Updated: 2026-08-05 12:21
VLAI
Title
net: ti: icssg-prueth: Fix memory leak in XDP_DROP for non-zero-copy mode
Summary
In the Linux kernel, the following vulnerability has been resolved: net: ti: icssg-prueth: Fix memory leak in XDP_DROP for non-zero-copy mode Page recycling was removed from the XDP_DROP path in emac_run_xdp() to avoid conflicts with AF_XDP zero-copy mode, which uses xsk_buff_free() instead. However, this causes a memory leak when running XDP programs that drop packets in non-zero-copy mode (standard page pool mode). The pages are never returned to the page pool, leading to OOM conditions. Fix this by handling cleanup in the caller, emac_rx_packet(). When emac_run_xdp() returns ICSSG_XDP_CONSUMED for XDP_DROP, the caller now recycles the page back to the page pool. The zero-copy path, emac_rx_packet_zc() already handles cleanup correctly with xsk_buff_free().
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 7a64bb388df3cf091afdd047c701039a13acd3b4 , < d16d57dedcb69c1a1257e0638f8698ce1f0ccbe5 (git)
Affected: 7a64bb388df3cf091afdd047c701039a13acd3b4 , < 719d3e71691db7c4f1658ba5a6d1472928121594 (git)
Create a notification for this product.
Linux Linux Affected: 6.19
Unaffected: 0 , < 6.19 (semver)
Unaffected: 6.19.10 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/ti/icssg/icssg_common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d16d57dedcb69c1a1257e0638f8698ce1f0ccbe5",
              "status": "affected",
              "version": "7a64bb388df3cf091afdd047c701039a13acd3b4",
              "versionType": "git"
            },
            {
              "lessThan": "719d3e71691db7c4f1658ba5a6d1472928121594",
              "status": "affected",
              "version": "7a64bb388df3cf091afdd047c701039a13acd3b4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/ti/icssg/icssg_common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.10",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ti: icssg-prueth: Fix memory leak in XDP_DROP for non-zero-copy mode\n\nPage recycling was removed from the XDP_DROP path in emac_run_xdp() to\navoid conflicts with AF_XDP zero-copy mode, which uses xsk_buff_free()\ninstead.\n\nHowever, this causes a memory leak when running XDP programs that drop\npackets in non-zero-copy mode (standard page pool mode). The pages are\nnever returned to the page pool, leading to OOM conditions.\n\nFix this by handling cleanup in the caller, emac_rx_packet().\nWhen emac_run_xdp() returns ICSSG_XDP_CONSUMED for XDP_DROP, the\ncaller now recycles the page back to the page pool. The zero-copy\npath, emac_rx_packet_zc() already handles cleanup correctly with\nxsk_buff_free()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable path is native RX packet processing in the TI ICSSG Ethernet driver, reached by packets arriving on the network interface. In a reasonable XDP firewall/drop deployment, a remote sender can supply packets that the installed XDP program drops.\nAC:L - Once the interface is running with a non-zero-copy XDP program that returns XDP_DROP, triggering the leak only requires sending matching packets. There is no race, timing window, or fragile memory-layout dependency.\nPR:N - The attacker does not need to load or attach the XDP program in the highest-impact scenario; the target is already configured with an XDP drop program. The triggering packets can be unauthenticated network traffic.\nUI:N - No victim user action is required during exploitation. Packet receipt and NAPI RX processing occur automatically on the running interface.\nS:U - The impact remains within the same kernel and host security authority. This is not a VM escape, IOMMU bypass, or cross-scope boundary violation.\nC:N - The bug is an unrecycled page-pool buffer leak on XDP_DROP, not an out-of-bounds access, use-after-free, or information disclosure. No attacker-readable data is exposed by this flaw.\nI:N - The leak does not corrupt memory or provide a write primitive. It only loses references to RX pages that should have been returned to the page pool.\nA:H - Each dropped packet in the affected mode can permanently leak a page, and sustained unauthenticated traffic can drive the system into OOM. On embedded or network-gateway deployments this can cause loss of service, process termination, watchdog reset, or system unavailability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:21:53.011Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d16d57dedcb69c1a1257e0638f8698ce1f0ccbe5"
        },
        {
          "url": "https://git.kernel.org/stable/c/719d3e71691db7c4f1658ba5a6d1472928121594"
        }
      ],
      "title": "net: ti: icssg-prueth: Fix memory leak in XDP_DROP for non-zero-copy mode",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23453",
    "datePublished": "2026-04-03T15:15:35.549Z",
    "dateReserved": "2026-01-13T15:37:46.020Z",
    "dateUpdated": "2026-08-05T12:21:53.011Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-23453",
      "date": "2026-08-07",
      "epss": "0.00343",
      "percentile": "0.26991"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-23453\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-04-03T16:16:31.820\",\"lastModified\":\"2026-07-24T21:10:00.143\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: ti: icssg-prueth: Fix memory leak in XDP_DROP for non-zero-copy mode\\n\\nPage recycling was removed from the XDP_DROP path in emac_run_xdp() to\\navoid conflicts with AF_XDP zero-copy mode, which uses xsk_buff_free()\\ninstead.\\n\\nHowever, this causes a memory leak when running XDP programs that drop\\npackets in non-zero-copy mode (standard page pool mode). The pages are\\nnever returned to the page pool, leading to OOM conditions.\\n\\nFix this by handling cleanup in the caller, emac_rx_packet().\\nWhen emac_run_xdp() returns ICSSG_XDP_CONSUMED for XDP_DROP, the\\ncaller now recycles the page back to the page pool. The zero-copy\\npath, emac_rx_packet_zc() already handles cleanup correctly with\\nxsk_buff_free().\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nnet: ti: icssg-prueth: Correcci\u00f3n de fuga de memoria en XDP_DROP para el modo sin copia cero\\n\\nEl reciclaje de p\u00e1ginas fue eliminado de la ruta XDP_DROP en emac_run_xdp() para evitar conflictos con el modo de copia cero de AF_XDP, que usa xsk_buff_free() en su lugar.\\n\\nSin embargo, esto causa una fuga de memoria al ejecutar programas XDP que descartan paquetes en modo sin copia cero (modo de pool de p\u00e1ginas est\u00e1ndar). Las p\u00e1ginas nunca son devueltas al pool de p\u00e1ginas, lo que lleva a condiciones de OOM.\\n\\nEsto se soluciona manejando la limpieza en la funci\u00f3n llamadora, emac_rx_packet(). Cuando emac_run_xdp() devuelve ICSSG_XDP_CONSUMED para XDP_DROP, la funci\u00f3n llamadora ahora recicla la p\u00e1gina de vuelta al pool de p\u00e1ginas. La ruta de copia cero, emac_rx_packet_zc(), ya maneja la limpieza correctamente con xsk_buff_free().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/ti/icssg/icssg_common.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7a64bb388df3cf091afdd047c701039a13acd3b4\",\"lessThan\":\"d16d57dedcb69c1a1257e0638f8698ce1f0ccbe5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7a64bb388df3cf091afdd047c701039a13acd3b4\",\"lessThan\":\"719d3e71691db7c4f1658ba5a6d1472928121594\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/ti/icssg/icssg_common.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.10\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-401\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.10\",\"matchCriteriaId\":\"96D34333-38BE-4414-9E79-6EB764329581\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F253B622-8837-4245-BCE5-A7BF8FC76A16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F666C8D8-6538-46D4-B318-87610DE64C34\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"02259FDA-961B-47BC-AE7F-93D7EC6E90C2\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/719d3e71691db7c4f1658ba5a6d1472928121594\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d16d57dedcb69c1a1257e0638f8698ce1f0ccbe5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-28T07:21:05+00:00",
      "cve": "CVE-2026-23453",
      "id": "CVE-2026-23453",
      "initial_release_date": "2026-04-03T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: ti: icssg-prueth: Fix memory leak in XDP_DROP for non-zero-copy mode",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23453.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.