https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 16:03:02 +0000 https://vulnerability.circl.lu/vuln/cve-2026-97955 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net: mana: restore the XDP program pointer when pre-allocation fails</p> <p>mana_xdp_set() publishes the new program into apc-&gt;bpf_prog before it allocates anything, because mana_pre_alloc_rxbufs() sizes the buffers from it via mana_get_rxbuf_cfg(). When that allocation fails the function returns the error directly, skipping the err_dealloc_rxbuffs label which is the only place that restores the previous pointer.</p> <p>The attach is reported as failed, so the BPF core drops the reference it held for the caller and the program can be freed, while apc-&gt;bpf_prog still points at it. The next consumer of mana_xdp_get() - typically mana_chn_setxdp() from mana_alloc_queues() on the following ifup, or after a TX timeout reset - then calls bpf_prog_add() on freed memory.</p> <p>This is reachable from an ordinary &#34;ip link set dev ethX xdp obj ...&#34; whenever the per-queue RX buffer pre-allocation cannot be satisfied.</p> <p>Restore the previous program on that error path.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net: mana: restore the XDP program pointer when pre-allocation fails</p> <p>mana_xdp_set() publishes the new program into apc-&gt;bpf_prog before it allocates anything, because mana_pre_alloc_rxbufs() sizes the buffers from it via mana_get_rxbuf_cfg(). When that allocation fails the function returns the error directly, skipping the err_dealloc_rxbuffs label which is the only place that restores the previous pointer.</p> <p>The attach is reported as failed, so the BPF core drops the reference it held for the caller and the program can be freed, while apc-&gt;bpf_prog still points at it. The next consumer of mana_xdp_get() - typically mana_chn_setxdp() from mana_alloc_queues() on the following ifup, or after a TX timeout reset - then calls bpf_prog_add() on freed memory.</p> <p>This is reachable from an ordinary &#34;ip link set dev ethX xdp obj ...&#34; whenever the per-queue RX buffer pre-allocation cannot be satisfied.</p> <p>Restore the previous program on that error path.</p> https://vulnerability.circl.lu/vuln/cve-2026-97955