CVE-2026-98486: net: ena: fix MMIO read buffer leak on probe failure
In the Linux kernel, the following vulnerability has been resolved:
net: ena: fix MMIO read buffer leak on probe failure
enadeviceinit() initializes the MMIO read mechanism with enacommmioregreadrequestinit(), which allocates a coherent DMA buffer for MMIO read responses.
The normal removal path releases this buffer through enacommmioregreadrequestdestroy(). However, if enaprobe() fails after enadeviceinit() succeeds, the error path destroys the admin resources and eventually frees enadev without destroying the MMIO read request, leaving the coherent DMA buffer allocated.
Call enacommmioregreadrequestdestroy() in the probe error path before releasing the remaining device resources.
This issue was found by manual code inspection.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.9-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.112 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.55 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.9 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Upgrade
Upgrade
azurelinux/kernelto a version that resolves this vulnerability.Fixed in 6.6.161.1-1 - Compensating control
In the ena probe error path, call ena_com_mmio_reg_read_request_destroy() after ena_device_init() succeeds and before releasing the remaining device resources, so the coherent MMIO read DMA buffer is freed.
Event History
Frequently Asked Questions
When can this leak occur?
It occurs only when the ENA driver's ena_probe() path fails after ena_device_init() has successfully initialized the MMIO read mechanism. Normal device removal releases the buffer correctly.
What resource is leaked?
The affected error path leaves a coherent DMA buffer allocated. That buffer is used for MMIO read responses and is normally released by ena_com_mmio_reg_read_request_destroy().
How can I determine whether the system is affected?
Review the ENA driver probe error path to determine whether it calls ena_com_mmio_reg_read_request_destroy() after ena_device_init() succeeds and before the remaining device resources are released. The issue was identified through manual code inspection.
What should be changed to remediate the issue?
Ensure the probe failure path calls ena_com_mmio_reg_read_request_destroy() before releasing the remaining device resources. The provided stable kernel references contain the corresponding fix.