Linux CVE-2026-23453

The Linux kernel's TI ICSSG PRU Ethernet driver (icssg-prueth) manages packet processing through XDP (eXpress Data Path) programs with two operational modes: standard page pool allocation and AF_XDP zero-copy mode. The vulnerability resides in the emac_run_xdp() function's XDP_DROP handling path. In zero-copy mode, AF_XDP uses xsk_buff_free() to return buffer ownership to user-space; however, page recycling was removed from the XDP_DROP path to avoid conflicts with this mechanism. This caused the non-zero-copy (standard page pool) path to lose page return logic entirely, meaning dropped packets in standard mode leave their page allocations unreturned. The fix implements conditional cleanup at the caller level (emac_rx_packet()) to distinguish between zero-copy and non-zero-copy contexts-when emac_run_xdp() returns ICSSG_XDP_CONSUMED for XDP_DROP, the standard path now recycles the page back to the kernel's page pool allocator via page_pool_recycle_direct() or similar APIs, while emac_rx_packet_zc() maintains its xsk_buff_free() semantics for user-space buffers.