CVE-2026-53229

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure

In the XSK branch of mlx5e_xmit_xdp_buff(), when sq->xmit_xdp_frame()

returns false (e.g. XDPSQ is full), the function returns without

unmapping the DMA address or freeing the xdp_frame allocated by

xdp_convert_zc_to_xdp_frame(). The xdpi_fifo push only happens on

success, so the completion path cannot recover these entries.

With CONFIG_DMA_API_DEBUG=y, the leak surfaces on driver unbind:

DMA-API: pci 0000:08:00.0: device driver has pending DMA

allocations while released from device [count=1116]

One of leaked entries details: [device address=0x000000010ffd7028]

[size=1534 bytes] [mapped with DMA_TO_DEVICE] [mapped as phy]

WARNING: kernel/dma/debug.c:881 at dma_debug_device_change+0x127/0x180

...

DMA-API: Mapped at:

debug_dma_map_phys+0x4b/0xd0

dma_map_phys+0xfd/0x2d0

mlx5e_xdp_handle+0x5ae/0xac0 [mlx5_core]

mlx5e_xsk_skb_fro

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References