Vulnerability-Lookup

CVE-2026-99028 (GCVE-0-2026-99028)

Vulnerability from cvelistv5 – Published: 2026-10-23 12:21 – Updated: 2026-10-23 12:21

Title

net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop

Summary

In the Linux kernel, the following vulnerability has been resolved: net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop In the dmaengine path the driver pre-submits RX buffers and holds in-flight TX buffers whose SKBs are DMA-mapped by the driver and freed only in the completion callbacks. On ndo_stop() dmaengine_terminate_sync() aborts these descriptors without running their callbacks, and the driver then frees only the ring shells, leaking every SKB still owned by the engine and its DMA mapping on each ifdown. With 128 RX buffers pre-posted per channel, the mapping leak can eventually exhaust a limited IOMMU aperture. Clear the slot's skb in the TX and RX callbacks so a non-NULL skb marks a slot that still owns a live, DMA-mapped buffer, and on stop unmap and free every such buffer. axienet_dma_rx_cb() runs from the DMA tasklet and re-arms the RX ring on each completion, so it can race axienet_stop(): a completion may submit a fresh buffer after dmaengine_terminate_sync() has returned, leaving the channel armed with a buffer the teardown then frees while the engine may still write into it (dma_release_channel() does not stop it either). Add a lock that axienet_dma_rx_cb() holds across the @stopping check and the resubmit, and axienet_stop() holds to set @stopping before terminating. Once @stopping is set no callback can arm a new buffer, and any armed just before is aborted by the terminate, so teardown only frees buffers the engine no longer owns.

Severity

No CVSS data available.

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 7061 records in the last 180 days details

References

4 references

URL	Tags
https://git.kernel.org/stable/c/079396129da5e7cb4…
https://git.kernel.org/stable/c/eececf7c3a679d9c0…
https://git.kernel.org/stable/c/5e5cf3ad7c099ff86…
https://git.kernel.org/stable/c/bcf2573a68a808a5b…

Impacted products

2 products

Vendor	Product	Version	CPE status
Linux	Linux	Affected: 6a91b846af85a24241decd686269e8e038eb13d1 , < 079396129da5e7cb40ca0920aa1b9525bef6097c (git) Affected: 6a91b846af85a24241decd686269e8e038eb13d1 , < eececf7c3a679d9c08175ad6bacbc8c31848f5af (git) Affected: 6a91b846af85a24241decd686269e8e038eb13d1 , < 5e5cf3ad7c099ff86ea9e422cddb25a2e5317b58 (git) Affected: 6a91b846af85a24241decd686269e8e038eb13d1 , < bcf2573a68a808a5b54cadafa72b6672e662c2bf (git)	guessed
Linux	Linux	Affected: 6.8 Unaffected: 0 , < 6.8 (semver) Unaffected: 6.12.114 , ≤ 6.12.* (semver) Unaffected: 6.18.58 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/xilinx/xilinx_axienet.h",
            "drivers/net/ethernet/xilinx/xilinx_axienet_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "079396129da5e7cb40ca0920aa1b9525bef6097c",
              "status": "affected",
              "version": "6a91b846af85a24241decd686269e8e038eb13d1",
              "versionType": "git"
            },
            {
              "lessThan": "eececf7c3a679d9c08175ad6bacbc8c31848f5af",
              "status": "affected",
              "version": "6a91b846af85a24241decd686269e8e038eb13d1",
              "versionType": "git"
            },
            {
              "lessThan": "5e5cf3ad7c099ff86ea9e422cddb25a2e5317b58",
              "status": "affected",
              "version": "6a91b846af85a24241decd686269e8e038eb13d1",
              "versionType": "git"
            },
            {
              "lessThan": "bcf2573a68a808a5b54cadafa72b6672e662c2bf",
              "status": "affected",
              "version": "6a91b846af85a24241decd686269e8e038eb13d1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/xilinx/xilinx_axienet.h",
            "drivers/net/ethernet/xilinx/xilinx_axienet_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.58",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.114",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.58",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.11",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop\n\nIn the dmaengine path the driver pre-submits RX buffers and holds\nin-flight TX buffers whose SKBs are DMA-mapped by the driver and freed\nonly in the completion callbacks. On ndo_stop() dmaengine_terminate_sync()\naborts these descriptors without running their callbacks, and the driver\nthen frees only the ring shells, leaking every SKB still owned by the\nengine and its DMA mapping on each ifdown. With 128 RX buffers pre-posted\nper channel, the mapping leak can eventually exhaust a limited IOMMU\naperture.\n\nClear the slot\u0027s skb in the TX and RX callbacks so a non-NULL skb marks a\nslot that still owns a live, DMA-mapped buffer, and on stop unmap and free\nevery such buffer.\n\naxienet_dma_rx_cb() runs from the DMA tasklet and re-arms the RX ring on\neach completion, so it can race axienet_stop(): a completion may submit a\nfresh buffer after dmaengine_terminate_sync() has returned, leaving the\nchannel armed with a buffer the teardown then frees while the engine may\nstill write into it (dma_release_channel() does not stop it either). Add a\nlock that axienet_dma_rx_cb() holds across the @stopping check and the\nresubmit, and axienet_stop() holds to set @stopping before terminating.\nOnce @stopping is set no callback can arm a new buffer, and any armed just\nbefore is aborted by the terminate, so teardown only frees buffers the\nengine no longer owns."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-23T12:21:20.294Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/079396129da5e7cb40ca0920aa1b9525bef6097c"
        },
        {
          "url": "https://git.kernel.org/stable/c/eececf7c3a679d9c08175ad6bacbc8c31848f5af"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e5cf3ad7c099ff86ea9e422cddb25a2e5317b58"
        },
        {
          "url": "https://git.kernel.org/stable/c/bcf2573a68a808a5b54cadafa72b6672e662c2bf"
        }
      ],
      "title": "net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-99028",
    "datePublished": "2026-10-23T12:21:20.294Z",
    "dateReserved": "2026-09-25T10:25:14.386Z",
    "dateUpdated": "2026-10-23T12:21:20.294Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-99028",
      "date": "2026-10-24",
      "epss": "0.00209",
      "percentile": "0.10535"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/xilinx/xilinx_axienet.h",
                  "drivers/net/ethernet/xilinx/xilinx_axienet_main.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "079396129da5e7cb40ca0920aa1b9525bef6097c",
                    "status": "affected",
                    "version": "6a91b846af85a24241decd686269e8e038eb13d1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "eececf7c3a679d9c08175ad6bacbc8c31848f5af",
                    "status": "affected",
                    "version": "6a91b846af85a24241decd686269e8e038eb13d1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5e5cf3ad7c099ff86ea9e422cddb25a2e5317b58",
                    "status": "affected",
                    "version": "6a91b846af85a24241decd686269e8e038eb13d1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bcf2573a68a808a5b54cadafa72b6672e662c2bf",
                    "status": "affected",
                    "version": "6a91b846af85a24241decd686269e8e038eb13d1",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/xilinx/xilinx_axienet.h",
                  "drivers/net/ethernet/xilinx/xilinx_axienet_main.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.8"
                  },
                  {
                    "lessThan": "6.8",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.114",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.58",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop\n\nIn the dmaengine path the driver pre-submits RX buffers and holds\nin-flight TX buffers whose SKBs are DMA-mapped by the driver and freed\nonly in the completion callbacks. On ndo_stop() dmaengine_terminate_sync()\naborts these descriptors without running their callbacks, and the driver\nthen frees only the ring shells, leaking every SKB still owned by the\nengine and its DMA mapping on each ifdown. With 128 RX buffers pre-posted\nper channel, the mapping leak can eventually exhaust a limited IOMMU\naperture.\n\nClear the slot\u0027s skb in the TX and RX callbacks so a non-NULL skb marks a\nslot that still owns a live, DMA-mapped buffer, and on stop unmap and free\nevery such buffer.\n\naxienet_dma_rx_cb() runs from the DMA tasklet and re-arms the RX ring on\neach completion, so it can race axienet_stop(): a completion may submit a\nfresh buffer after dmaengine_terminate_sync() has returned, leaving the\nchannel armed with a buffer the teardown then frees while the engine may\nstill write into it (dma_release_channel() does not stop it either). Add a\nlock that axienet_dma_rx_cb() holds across the @stopping check and the\nresubmit, and axienet_stop() holds to set @stopping before terminating.\nOnce @stopping is set no callback can arm a new buffer, and any armed just\nbefore is aborted by the terminate, so teardown only frees buffers the\nengine no longer owns."
          }
        ],
        "id": "CVE-2026-99028",
        "lastModified": "2026-10-23T13:17:25.843",
        "metrics": {},
        "published": "2026-10-23T13:17:25.843",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/079396129da5e7cb40ca0920aa1b9525bef6097c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5e5cf3ad7c099ff86ea9e422cddb25a2e5317b58"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bcf2573a68a808a5b54cadafa72b6672e662c2bf"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/eececf7c3a679d9c08175ad6bacbc8c31848f5af"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}

FKIE_CVE-2026-99028

Vulnerability from fkie_nvd - Published: 2026-10-23 13:17 - Updated: 2026-10-23 13:17

Severity

Summary

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/079396129da5e7cb40ca0920aa1b9525bef6097c
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/5e5cf3ad7c099ff86ea9e422cddb25a2e5317b58
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/bcf2573a68a808a5b54cadafa72b6672e662c2bf
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/eececf7c3a679d9c08175ad6bacbc8c31848f5af

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/xilinx/xilinx_axienet.h",
            "drivers/net/ethernet/xilinx/xilinx_axienet_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "079396129da5e7cb40ca0920aa1b9525bef6097c",
              "status": "affected",
              "version": "6a91b846af85a24241decd686269e8e038eb13d1",
              "versionType": "git"
            },
            {
              "lessThan": "eececf7c3a679d9c08175ad6bacbc8c31848f5af",
              "status": "affected",
              "version": "6a91b846af85a24241decd686269e8e038eb13d1",
              "versionType": "git"
            },
            {
              "lessThan": "5e5cf3ad7c099ff86ea9e422cddb25a2e5317b58",
              "status": "affected",
              "version": "6a91b846af85a24241decd686269e8e038eb13d1",
              "versionType": "git"
            },
            {
              "lessThan": "bcf2573a68a808a5b54cadafa72b6672e662c2bf",
              "status": "affected",
              "version": "6a91b846af85a24241decd686269e8e038eb13d1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/xilinx/xilinx_axienet.h",
            "drivers/net/ethernet/xilinx/xilinx_axienet_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.58",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop\n\nIn the dmaengine path the driver pre-submits RX buffers and holds\nin-flight TX buffers whose SKBs are DMA-mapped by the driver and freed\nonly in the completion callbacks. On ndo_stop() dmaengine_terminate_sync()\naborts these descriptors without running their callbacks, and the driver\nthen frees only the ring shells, leaking every SKB still owned by the\nengine and its DMA mapping on each ifdown. With 128 RX buffers pre-posted\nper channel, the mapping leak can eventually exhaust a limited IOMMU\naperture.\n\nClear the slot\u0027s skb in the TX and RX callbacks so a non-NULL skb marks a\nslot that still owns a live, DMA-mapped buffer, and on stop unmap and free\nevery such buffer.\n\naxienet_dma_rx_cb() runs from the DMA tasklet and re-arms the RX ring on\neach completion, so it can race axienet_stop(): a completion may submit a\nfresh buffer after dmaengine_terminate_sync() has returned, leaving the\nchannel armed with a buffer the teardown then frees while the engine may\nstill write into it (dma_release_channel() does not stop it either). Add a\nlock that axienet_dma_rx_cb() holds across the @stopping check and the\nresubmit, and axienet_stop() holds to set @stopping before terminating.\nOnce @stopping is set no callback can arm a new buffer, and any armed just\nbefore is aborted by the terminate, so teardown only frees buffers the\nengine no longer owns."
    }
  ],
  "id": "CVE-2026-99028",
  "lastModified": "2026-10-23T13:17:25.843",
  "metrics": {},
  "published": "2026-10-23T13:17:25.843",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/079396129da5e7cb40ca0920aa1b9525bef6097c"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/5e5cf3ad7c099ff86ea9e422cddb25a2e5317b58"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/bcf2573a68a808a5b54cadafa72b6672e662c2bf"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/eececf7c3a679d9c08175ad6bacbc8c31848f5af"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

GHSA-5XGG-2G43-R4GH

Vulnerability from github – Published: 2026-10-23 15:31 – Updated: 2026-10-23 15:31

Details

In the Linux kernel, the following vulnerability has been resolved:

net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop

In the dmaengine path the driver pre-submits RX buffers and holds in-flight TX buffers whose SKBs are DMA-mapped by the driver and freed only in the completion callbacks. On ndo_stop() dmaengine_terminate_sync() aborts these descriptors without running their callbacks, and the driver then frees only the ring shells, leaking every SKB still owned by the engine and its DMA mapping on each ifdown. With 128 RX buffers pre-posted per channel, the mapping leak can eventually exhaust a limited IOMMU aperture.

Clear the slot's skb in the TX and RX callbacks so a non-NULL skb marks a slot that still owns a live, DMA-mapped buffer, and on stop unmap and free every such buffer.

axienet_dma_rx_cb() runs from the DMA tasklet and re-arms the RX ring on each completion, so it can race axienet_stop(): a completion may submit a fresh buffer after dmaengine_terminate_sync() has returned, leaving the channel armed with a buffer the teardown then frees while the engine may still write into it (dma_release_channel() does not stop it either). Add a lock that axienet_dma_rx_cb() holds across the @stopping check and the resubmit, and axienet_stop() holds to set @stopping before terminating. Once @stopping is set no callback can arm a new buffer, and any armed just before is aborted by the terminate, so teardown only frees buffers the engine no longer owns.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-99028"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-23T13:17:25Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop\n\nIn the dmaengine path the driver pre-submits RX buffers and holds\nin-flight TX buffers whose SKBs are DMA-mapped by the driver and freed\nonly in the completion callbacks. On ndo_stop() dmaengine_terminate_sync()\naborts these descriptors without running their callbacks, and the driver\nthen frees only the ring shells, leaking every SKB still owned by the\nengine and its DMA mapping on each ifdown. With 128 RX buffers pre-posted\nper channel, the mapping leak can eventually exhaust a limited IOMMU\naperture.\n\nClear the slot\u0027s skb in the TX and RX callbacks so a non-NULL skb marks a\nslot that still owns a live, DMA-mapped buffer, and on stop unmap and free\nevery such buffer.\n\naxienet_dma_rx_cb() runs from the DMA tasklet and re-arms the RX ring on\neach completion, so it can race axienet_stop(): a completion may submit a\nfresh buffer after dmaengine_terminate_sync() has returned, leaving the\nchannel armed with a buffer the teardown then frees while the engine may\nstill write into it (dma_release_channel() does not stop it either). Add a\nlock that axienet_dma_rx_cb() holds across the @stopping check and the\nresubmit, and axienet_stop() holds to set @stopping before terminating.\nOnce @stopping is set no callback can arm a new buffer, and any armed just\nbefore is aborted by the terminate, so teardown only frees buffers the\nengine no longer owns.",
  "id": "GHSA-5xgg-2g43-r4gh",
  "modified": "2026-10-23T15:31:35Z",
  "published": "2026-10-23T15:31:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99028"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/079396129da5e7cb40ca0920aa1b9525bef6097c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5e5cf3ad7c099ff86ea9e422cddb25a2e5317b58"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/bcf2573a68a808a5b54cadafa72b6672e662c2bf"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/eececf7c3a679d9c08175ad6bacbc8c31848f5af"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-99028 (GCVE-0-2026-99028)

FKIE_CVE-2026-99028

GHSA-5XGG-2G43-R4GH

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour