External risk intelligence

Linux Kernel MLX5E AF_XDP Buffer Release Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-99078

This vulnerability exists within the Linux kernel networking subsystem, specifically related to the mlx5e driver and AF_XDP memory management. These are low-level kernel components that handle packet processing. They are not internet-facing services or applications; they operate at the driver level and are not directly reachable from the public internet.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a vulnerability in the Linux kernel's networking component, specifically within the mlx5e driver when handling AF_XDP. The issue stems from how network buffers are managed during certain allocation failures, potentially leading to repeated freeing of the same memory, which has been resolved.

Stale buffer releases on network retries.
Potential for repeated memory freeing.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

Attackers could exploit a flaw in the Linux kernel's networking component, specifically within the mlx5e driver when using AF_XDP with a striding RQ. This occurs when the system runs out of memory during buffer allocation for packet processing. The vulnerability allows for the same packet buffer to be freed multiple times, which could lead to system instability or crashes.

Entry condition: Network access with AF_XDP on a striding RQ.
Trigger point: Memory allocation failure during buffer refill.
Resulting risk: System instability or crash.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow a local attacker to cause a denial-of-service condition by repeatedly triggering a buffer release error in the Linux kernel's networking subsystem when using AF_XDP with a striding receive queue. This could lead to system instability or crashes.

Kernel network buffers could be impacted.
Repeated allocation failures may cause issues.
System instability or denial-of-service.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability exists in the Linux kernel's networking subsystem, affecting how AF_XDP handles XSK buffers. Real-world ownership likely falls to infrastructure or platform teams responsible for the kernel and network stack, with coordination from security teams. The first practical step is to identify systems running the affected kernel version and assess their exposure, particularly those using AF_XDP in high-performance networking scenarios.

Kernel and network teams own.
Verify AF_XDP, striding RQ usage.
Plan kernel updates by risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the mlx5e driver in the Linux kernel?

The mlx5e driver is a component of the Linux kernel used to manage Mellanox Technologies' ConnectX family of network interface cards. It handles high-performance network traffic processing. This specific vulnerability affects how the driver manages AF_XDP, a feature designed for high-speed packet processing that allows applications to bypass parts of the standard kernel networking stack for improved efficiency.

What is the nature of the flaw in CVE-2026-99078?

This vulnerability involves a memory management error, specifically a double-free condition. When the system fails to allocate memory during a network buffer refill, the driver may attempt to release the same memory buffer multiple times. This occurs because the driver loses track of which buffers have already been processed, leading to a state where the kernel incorrectly handles the same memory resource twice.

How is this memory error triggered?

The issue is triggered when a system using AF_XDP with a striding receive queue experiences a memory allocation failure. It does not occur during normal, successful operation. If the driver hits an out-of-memory error, the kernel retry mechanism can mistakenly re-process buffers that were already released. If the memory allocation succeeds on the first attempt, the buffer management remains stable and the error is not triggered.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal indicates it is very unlikely that this vulnerability is directly reachable. While the bug exists in the kernel, it resides in low-level driver components that manage internal memory, not in internet-facing services. Because these components function well below the application layer, they are not directly exposed to external network traffic or public-facing internet services.

What should I do to address this vulnerability?

First, identify if your infrastructure utilizes the mlx5e driver and AF_XDP in high-performance networking environments. Since this is a kernel-level issue, remediation involves planning a kernel update. Coordinate with your platform or infrastructure teams to verify your current configuration and prepare to apply the necessary kernel patches once they are available from your distribution provider.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.