CVE-2026-98492: net: macb: fix dma_alloc_coherent() leak on macb_alloc() error paths
In the Linux kernel, the following vulnerability has been resolved:
net: macb: fix dmaalloccoherent() leak on macballoc() error paths
Fix 3 leaks in macballoc() error paths: - Tx buffer allocated but crossing a 4G boundary: Tx leaked. - Rx buffer allocation fails: Tx leaked. - Rx buffer allocated but crossing a 4G boundary: Tx & Rx leaked.
This is because our error handling calls macbfree(bp) which in turn frees the buffers stored in bp->queues[0], but nothing has been stored in there. Fix by storing allocated buffers into bp->queues[0] ASAP.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In macb_alloc() error paths, store allocated Tx and Rx buffers into bp->queues[0] as soon as they are allocated so macb_free(bp) can release them, including allocations that cross a 4G boundary and failed Rx buffer allocations.
Event History
Frequently Asked Questions
What conditions trigger the memory leak?
The leak occurs only when macb_alloc() takes an error path after DMA-coherent buffer allocation: when the transmit buffer crosses a 4 GB boundary, when receive-buffer allocation fails after transmit allocation, or when the receive buffer crosses a 4 GB boundary after both buffers are allocated.
What resources can remain leaked?
Depending on the failure path, the transmit DMA-coherent buffer alone or both transmit and receive DMA-coherent buffers can remain allocated. The affected cleanup path calls macb_free(bp), but the allocated buffers have not yet been stored in bp->queues[0] for that function to free them.