Skip to main content

Linux Kernel EUVDEUVD-2026-39320

| CVE-2026-53229 HIGH
Memory Leak (CWE-401)
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-gvrm-xh5g-w8v6
Information Disclosure Linux
7.5
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Reach mlx5 NIC running XSK zero-copy
  2. Delivery
    Send sustained high-rate traffic flow
  3. Exploit
    Saturate XDP send queue (XDPSQ full)
  4. Install
    Trigger XDP_TX xmit-failure leak path
  5. C2
    Leak DMA mappings and xdp_frames repeatedly
  6. Execute
    Exhaust kernel memory / DMA resources
  7. Impact
    Host instability or denial of service

Vulnerability Assessment

Weakness
CWE
CWE-401
ASVS 5.0
V15 - Secure Coding and Architecture Resource cleanup, leak prevention
Exploitation Conditions

Requires the host to be running AF_XDP (XSK) sockets in zero-copy mode on a mlx5 (NVIDIA/Mellanox ConnectX) interface with an attached XDP program that uses the XDP_TX action - this is a specialized, non-default networking configuration. The leak only occurs on the XDP_TX transmit-failure branch, i.e. when sq->xmit_xdp_frame() returns false because the XDP send queue (XDPSQ) is full, so an attacker (or workload) must drive enough traffic to saturate that queue. The has_frags multi-buffer case is rejected earlier and is not involved. Limiting factors: it does not affect default kernels without AF_XDP zero-copy, requires specific Mellanox hardware, impacts availability only (no code execution or data disclosure described), and manifests as gradual resource leakage rather than an immediate crash.
Impact

Signals conflict and should temper the headline CVSS 7.5. The supplied vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H scores network, unauthenticated, low-complexity availability impact - but the description shows a gradual DMA/memory leak that only triggers on the XDP_TX failure path (send queue full) and only on hosts explicitly configured for AF_XDP zero-copy on mlx5 hardware, which is neither a default configuration nor a trivially remote-triggerable condition. EPSS is low (0.18%, percentile 7%), there is no KEV listing, and no POC is indicated, all consistent with low practical exploitation likelihood. The 'Information Disclosure' tag also conflicts with the C:N/I:N/A:H vector (no confidentiality impact is described) - treat the tag as inaccurate and rely on the availability-only impact. Net: a legitimate stability bug for XSK-heavy deployments, but the AV:N/A:H rating overstates ease of deliberate remote exploitation; verify the attack vector against your deployment before prioritizing as a network-facing DoS.
Exploit ScenarioDerived

On a host running an AF_XDP zero-copy application on a Mellanox ConnectX NIC, a sustained high-rate traffic flow keeps the XDP send queue full so XDP_TX transmits repeatedly fail; each failure leaks an xdp_frame and a DMA mapping. Over time the accumulating leaked DMA mappings and kernel memory degrade host stability and can surface as warnings or resource exhaustion. No public exploit code is identified, and reliable triggering depends on the specific XSK configuration and queue conditions.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 28, 2026

Resource exhaustion (DMA mapping and xdp_frame leak) in the Linux kernel's mlx5e driver affects systems using AF_XDP (XSK) zero-copy sockets on NVIDIA/Mellanox ConnectX NICs. In the XSK path of mlx5e_xmit_xdp_buff(), an XDP_TX transmit failure (e.g. a full XDP send queue) returns without unmapping the DMA address or freeing the converted xdp_frame, slowly leaking kernel memory and DMA mappings until availability degrades. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and the issue is not in CISA KEV, so real-world risk is gradual leakage under heavy XSK workloads rather than direct remote compromise.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.12.94, 6.18.36, 7.0.13, or 7.1 (or your distribution's backport containing the listed stable commits). The fix adds the missing dma_unmap plus xdp_return_frame on the XDP_TX failure path, mirroring the cleanup already in mlx5e_xdp_xmit(). If immediate patching is not possible, the practical compensating control is to avoid the vulnerable code path: disable AF_XDP zero-copy on mlx5 interfaces (run XSK in copy mode or remove the XDP program), which eliminates the leak at the cost of losing zero-copy performance for those sockets. Reducing sustained pressure that fills the XDP send queue (the trigger for the failure branch) lowers the leak rate but does not prevent it, so treat that only as interim mitigation. Apply the relevant stable commits from https://git.kernel.org/stable/c/0aabca726b43d833721034e97d99efcc8237b22a (and the related commits above) when building custom kernels.

Affected VersionsENISA

Linux 84a0a2310d6de247335574649726cb000c7c0074 <b69004f5a6ad32da84d8aa5b23b9c0caafe6252e
Linux 84a0a2310d6de247335574649726cb000c7c0074 <2789b74ae1f4b68333c9d5eec2f3354d07b16e61
Linux patch: 6.12.94
Linux 84a0a2310d6de247335574649726cb000c7c0074 <7b3eeba50fbc3b45f279037c29a87a90e8bac1e1
Linux patch: 0
Linux 84a0a2310d6de247335574649726cb000c7c0074 <0aabca726b43d833721034e97d99efcc8237b22a
Linux patch: 6.18.36
Linux patch: 7.1
Linux 5.3
Linux patch: 7.0.13

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The flaw lives in the mlx5_core driver's eXpress Data Path (XDP) handling for AF_XDP zero-copy sockets (XSK). When a redirected/transmitted packet takes the XDP_TX branch, xdp_convert_zc_to_xdp_frame() allocates an xdp_frame and the buffer is DMA-mapped with DMA_TO_DEVICE. The driver only pushes the bookkeeping entry into the xdpi_fifo on a successful sq->xmit_xdp_frame(); when that call returns false (queue full), the early return skips both dma_unmap and xdp_return_frame, so the completion path can never reclaim the entry. The CWE is listed as N/A, but the root-cause class is missing release of a resource after effective lifetime - CWE-401 (Missing Release of Memory) / CWE-772 (Missing Release of Resource). The leak is detectable with CONFIG_DMA_API_DEBUG=y, which warns of pending DMA allocations on driver unbind (dma_debug_device_change). No CPE strings were supplied; affected scope is inferred from the EUVD git-range and kernel version data.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 2.5 LOW

Requires a configured AF_XDP zero-copy setup (PR:L) and a hard-to-force SQ-full failure path (AC:H), causing only gradual resource leakage (A:L) with no confidentiality or integrity impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.5 MEDIUM

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.5 (HIGH)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 25, 2026 - 09:16 cve.org
HIGH 7.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure

In the XSK branch of mlx5e_xmit_xdp_buff(), when sq->xmit_xdp_frame() returns false (e.g. XDPSQ is full), the function returns without unmapping the DMA address or freeing the xdp_frame allocated by xdp_convert_zc_to_xdp_frame(). The xdpi_fifo push only happens on success, so the completion path cannot recover these entries.

With CONFIG_DMA_API_DEBUG=y, the leak surfaces on driver unbind:

DMA-API: pci 0000:08:00.0: device driver has pending DMA allocations while released from device [count=1116] One of leaked entries details: [device address=0x000000010ffd7028] [size=1534 bytes] [mapped with DMA_TO_DEVICE] [mapped as phy] WARNING: kernel/dma/debug.c:881 at dma_debug_device_change+0x127/0x180 ... DMA-API: Mapped at: debug_dma_map_phys+0x4b/0xd0 dma_map_phys+0xfd/0x2d0 mlx5e_xdp_handle+0x5ae/0xac0 [mlx5_core] mlx5e_xsk_skb_from_cqe_mpwrq_linear+0xc4/0x170 [mlx5_core] mlx5e_handle_rx_cqe_mpwrq+0xc1/0x290 [mlx5_core]

Add the missing unmap + xdp_return_frame, matching the cleanup already done in mlx5e_xdp_xmit(). has_frags is rejected earlier in this branch, so no per-frag unmap is needed.

Executive ViewAI

Why It Matters

A resource exhaustion vulnerability in the Linux kernel's mlx5e driver (NVIDIA/Mellanox ConnectX NICs) causes kernel memory and DMA mapping leaks when packet processing fails under AF_XDP zero-copy socket workloads. Organizations running high-performance networking or packet processing systems on affected hardware will experience gradual availability degradation over time without patching.

Business Impact: Medium
Compensating Controls

Apply vendor patch. Interim mitigation: if patching cannot be completed immediately, monitor system memory utilization and DMA mapping saturation on affected systems; disable or reduce AF_XDP/XSK workload intensity if degradation is observed.

Threat Intelligence Overview

EPSS Score
0.2%
Top 93% exploitable
Prevalence
Medium
mlx5/ConnectX NICs common in datacenters, but AF_XDP zero-copy path is niche
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
Medium

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2025-25469 HIGH POC
8.8
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.177 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.155 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.206 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.152 Affected
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected
Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53229 ADVISORY https://ubuntu.com/security/notices/USN-8726-1 ADVISORY https://ubuntu.com/security/notices/USN-8727-1 ADVISORY https://vuldb.com/vuln/373732 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22742/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22769/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3130/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3166/ REF https://git.kernel.org/stable/c/0aabca726b43d833721034e97d99efcc8237b22a REF https://git.kernel.org/stable/c/2789b74ae1f4b68333c9d5eec2f3354d07b16e61 REF https://git.kernel.org/stable/c/3bad189a31eb78575ea69f093e8ef5b7e3e8c832 REF https://git.kernel.org/stable/c/7b3eeba50fbc3b45f279037c29a87a90e8bac1e1 REF https://git.kernel.org/stable/c/b69004f5a6ad32da84d8aa5b23b9c0caafe6252e REF https://git.kernel.org/stable/c/bf0247d34d79d2740b3f1d6cc44dbd38ab2b169e

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy