Bug 2559761 (CVE-2026-99047)

Summary:	CVE-2026-99047 kernel: gve: fix XSK buffer leak when rings are stopped
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Google Virtual Ethernet (gve) driver in the Linux kernel. When stopping network queues and resetting the ring state, the driver fails to release eXpress Data Path socket (XSK) buffers posted to the network interface. A local user with network administrative privileges can trigger this issue by reconfiguring or stopping queues, leading to a memory leak and a potential Denial of Service (DoS) due to resource exhaustion.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-23 13:32:06 UTC

In the Linux kernel, the following vulnerability has been resolved:

gve: fix XSK buffer leak when rings are stopped

GVE does not free XSK buffers when resetting ring state as a part of
stopping queues. This causes all XSK buffers which are posted to the
NIC to be leaked.

Free XSK buffers attached to an allocated buf_state when stopping rings.

This issue was hit in production.

Comment 1 gkamathe 2026-10-28 04:53:09 UTC

Upstream advisory:
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99047.mbox