Is there a patch available for EUVD-2026-108852?

Yes, a patch is available for EUVD-2026-108852. Update the affected software to the latest version immediately.

Linux EUVD-2026-108852

| CVE-2026-99057

2026-10-23 Linux

GHSA-32c4-hc77-g5cm

Information Disclosure Linux

View

Monitor Track and reassess. Why: No CVSS yet + weak signal (CWE or non-zero EPSS).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisCVE.org

In the Linux kernel, the following vulnerability has been resolved:

xen/netfront: don't leak the skb when xennet_fill_frags() fails

When a response chain has more slots than fit in the skb's frags, xennet_fill_frags() returns an error and xennet_poll() jumps to its error path. That path moves what's left on tmpq to errq to be freed, but the skb being filled was already dequeued from tmpq, so it's never freed. Each chain that overflows leaks the skb and the pages attached to it as frags, and the backend decides how many slots it sends.

Put the skb back on tmpq before taking the error path, like the xennet_set_skb_gso() failure just above it does.

Affected VersionsENISA

Linux 4.18.11 <4.19

Linux patch: 6.12.113

Linux 4.14.73 <4.15

Linux patch: 7.3

Linux bd1468048aa3e2af865da92990539946d4483989

Linux 4.9.130 <4.10

Linux ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c <84e3ea6502b5f14ce8d499d0b6e0e38386274cf0

Linux ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c <5051df031144753d3e18862514969146b601d089

Linux ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c <086944c1c2cbb683543bc3ff08637847b03c8009

Linux b73a161e9beff24bf1803ba393dff95a255268f9

Linux ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c <99011a11c97340ef7290df7dc199305c73fab2f2

Linux patch: 6.6.160

Linux 4.19

Linux 4.4.159 <4.5

Linux 7eced4478f4ec6ff0a603ddfd6e24a5d3831fca7

Linux patch: 7.2.11

Linux ad4f15dc2c70b1de5e0a64d27335962fbc9cf71c <93ccaf1c26e2133396173b76a071e59024daa622

Linux patch: 6.18.57

Linux patch: 0

Linux 29a6193c0d74390c004808441061ac1812cf6f51

Affected Packages

euvd linux fix: 4.5, 4.10, 4.15, 4.19

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Lifecycle Timeline

Patch available

Oct 23, 2026 - 13:17 EUVD

CVE Published

Oct 23, 2026 - 12:22 cve.org

UNKNOWN (no severity yet)

Threat Intelligence Overview

EPSS Score

0.2%

Top 90% exploitable

Data Quality

3 sources

Confidence: Low

EUVD

CVE.org

EPSS MSRC

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity Not scored yet

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

No CVSS yet + weak signal (CWE or non-zero EPSS)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.