https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 13:41:11 +0000 https://vulnerability.circl.lu/vuln/cve-2026-97952 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>sunvdc: unmap LDC cookies when the descriptor send fails</p> <p>__send_request() maps the request&#39;s pages into the LDC channel&#39;s map table (ldc_map_sg()), fills in the descriptor and marks it VIO_DESC_READY before ringing the doorbell via __vdc_tx_trigger(). When the trigger fails, the error path only prints a message: the descriptor stays READY and the cookies are never unmapped. The mapping is normally released in vdc_end_one() when the peer completes the descriptor - but a descriptor whose doorbell was never sent will never complete, and since dr-&gt;prod is not advanced on failure, the reset path (vdc_requeue_inflight(), which walks [cons, prod)) never visits it either. The map table entries are leaked permanently.</p> <p>Since commit a11f6ca9aef9 (&#34;sunvdc: Do not spin in an infinite loop when vio_ldc_send() returns EAGAIN&#34;) trigger failures occur in practice under load, so every resulting I/O error also leaks one request&#39;s worth of entries from the fixed-size (8192 entries per channel) map table. Because the allocator hands out contiguous ranges, fragmentation makes large multi-segment requests fail first as the table drains, until ldc_map_sg() fails permanently and the disk is dead until reboot.</p> <p>It also makes any retry-based recovery unusable: requeuing the request on -EAGAIN remaps the pages on every attempt, overwriting desc-&gt;cookies and orphaning the previous mapping, so the table drains at the retry rate. This…</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>sunvdc: unmap LDC cookies when the descriptor send fails</p> <p>__send_request() maps the request&#39;s pages into the LDC channel&#39;s map table (ldc_map_sg()), fills in the descriptor and marks it VIO_DESC_READY before ringing the doorbell via __vdc_tx_trigger(). When the trigger fails, the error path only prints a message: the descriptor stays READY and the cookies are never unmapped. The mapping is normally released in vdc_end_one() when the peer completes the descriptor - but a descriptor whose doorbell was never sent will never complete, and since dr-&gt;prod is not advanced on failure, the reset path (vdc_requeue_inflight(), which walks [cons, prod)) never visits it either. The map table entries are leaked permanently.</p> <p>Since commit a11f6ca9aef9 (&#34;sunvdc: Do not spin in an infinite loop when vio_ldc_send() returns EAGAIN&#34;) trigger failures occur in practice under load, so every resulting I/O error also leaks one request&#39;s worth of entries from the fixed-size (8192 entries per channel) map table. Because the allocator hands out contiguous ranges, fragmentation makes large multi-segment requests fail first as the table drains, until ldc_map_sg() fails permanently and the disk is dead until reboot.</p> <p>It also makes any retry-based recovery unusable: requeuing the request on -EAGAIN remaps the pages on every attempt, overwriting desc-&gt;cookies and orphaning the previous mapping, so the table drains at the retry rate. This…</p> https://vulnerability.circl.lu/vuln/cve-2026-97952