CVE-2026-53229: net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: xsk: Fix DMA and xdpframe leak on XDPTX xmit failure
In the XSK branch of mlx5exmitxdpbuff(), when sq->xmitxdpframe() returns false (e.g. XDPSQ is full), the function returns without unmapping the DMA address or freeing the xdpframe allocated by xdpconvertzctoxdpframe(). The xdpififo push only happens on success, so the completion path cannot recover these entries.
With CONFIGDMAAPIDEBUG=y, the leak surfaces on driver unbind:
DMA-API: pci 0000:08:00.0: device driver has pending DMA allocations while released from device [count=1116] One of leaked entries details: [device address=0x000000010ffd7028] [size=1534 bytes] [mapped with DMATODEVICE] [mapped as phy] WARNING: kernel/dma/debug.c:881 at dmadebugdevicechange+0x127/0x180 ... DMA-API: Mapped at: debugdmamapphys+0x4b/0xd0 dmamapphys+0xfd/0x2d0 mlx5exdphandle+0x5ae/0xac0 [mlx5core] mlx5exskskbfromcqempwrqlinear+0xc4/0x170 [mlx5core] mlx5ehandlerxcqempwrq+0xc1/0x290 [mlx5core]
Add the missing unmap + xdpreturnframe, matching the cleanup already done in mlx5exdpxmit(). hasfrags is rejected earlier in this branch, so no per-frag unmap is needed.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53229?
CVE-2026-53229 has a risk rating of 12, indicating a critical severity level.
How do I fix CVE-2026-53229?
To mitigate CVE-2026-53229, update to the latest version of the Linux kernel where the vulnerability is patched.
What systems are affected by CVE-2026-53229?
CVE-2026-53229 affects the Linux kernel specifically in the mlx5e module.
What does CVE-2026-53229 exploit?
CVE-2026-53229 exploits a DMA and xdp_frame leak that occurs during XDP_TX xmit failures.
When was CVE-2026-53229 published?
CVE-2026-53229 was published on June 25, 2026.