GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2026-68135

Vulnerability from fkie_nvd - Published: 2026-08-10 13:19 - Updated: 2026-08-19 17:20
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: net: hip04: fix RX buffer leak on build_skb failure When build_skb() fails in hip04_rx_poll(), the driver jumps to the refill path without releasing the current RX buffer and its DMA mapping. Installing a replacement buffer then overwrites the slot references and leaks both resources. Keep the current slot intact and return budget so NAPI retries the same buffer. Also free a newly allocated RX fragment when dma_map_single() fails. This issue was found by an in-house static analysis tool.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/14fa65d10f5696b063a7d8d26e8291ea84a2c6ed
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2b19fe277645fd1aeb18fd4ecdcf31966080dee7
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/67a7614bde310da006ab259f4f163d3fb0f9e253
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/690ecc13a4032e5cae1dc6659512f32b033533b0
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/80d977f280b4eccd4ac5369871d0ecb2b9c9a49d
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a0f247d63489a107bbc3b712a77b302af2a2a173
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/bcd43ee1f25b682151df213c06a99b2e1c1cf2e5
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e054dcd990d8180cde529ea28ce0838e76a5ad5e
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/hisilicon/hip04_eth.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "690ecc13a4032e5cae1dc6659512f32b033533b0",
              "status": "affected",
              "version": "701a0fd5231866db08cebcd502894699f49cb960",
              "versionType": "git"
            },
            {
              "lessThan": "2b19fe277645fd1aeb18fd4ecdcf31966080dee7",
              "status": "affected",
              "version": "701a0fd5231866db08cebcd502894699f49cb960",
              "versionType": "git"
            },
            {
              "lessThan": "bcd43ee1f25b682151df213c06a99b2e1c1cf2e5",
              "status": "affected",
              "version": "701a0fd5231866db08cebcd502894699f49cb960",
              "versionType": "git"
            },
            {
              "lessThan": "e054dcd990d8180cde529ea28ce0838e76a5ad5e",
              "status": "affected",
              "version": "701a0fd5231866db08cebcd502894699f49cb960",
              "versionType": "git"
            },
            {
              "lessThan": "67a7614bde310da006ab259f4f163d3fb0f9e253",
              "status": "affected",
              "version": "701a0fd5231866db08cebcd502894699f49cb960",
              "versionType": "git"
            },
            {
              "lessThan": "80d977f280b4eccd4ac5369871d0ecb2b9c9a49d",
              "status": "affected",
              "version": "701a0fd5231866db08cebcd502894699f49cb960",
              "versionType": "git"
            },
            {
              "lessThan": "a0f247d63489a107bbc3b712a77b302af2a2a173",
              "status": "affected",
              "version": "701a0fd5231866db08cebcd502894699f49cb960",
              "versionType": "git"
            },
            {
              "lessThan": "14fa65d10f5696b063a7d8d26e8291ea84a2c6ed",
              "status": "affected",
              "version": "701a0fd5231866db08cebcd502894699f49cb960",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/hisilicon/hip04_eth.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.5"
            },
            {
              "lessThan": "4.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hip04: fix RX buffer leak on build_skb failure\n\nWhen build_skb() fails in hip04_rx_poll(), the driver jumps to the\nrefill path without releasing the current RX buffer and its DMA mapping.\nInstalling a replacement buffer then overwrites the slot references and\nleaks both resources.\n\nKeep the current slot intact and return budget so NAPI retries the same\nbuffer.  Also free a newly allocated RX fragment when dma_map_single()\nfails.\n\nThis issue was found by an in-house static analysis tool."
    }
  ],
  "id": "CVE-2026-68135",
  "lastModified": "2026-08-19T17:20:30.757",
  "metrics": {},
  "published": "2026-08-10T13:19:58.990",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/14fa65d10f5696b063a7d8d26e8291ea84a2c6ed"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/2b19fe277645fd1aeb18fd4ecdcf31966080dee7"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/67a7614bde310da006ab259f4f163d3fb0f9e253"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/690ecc13a4032e5cae1dc6659512f32b033533b0"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/80d977f280b4eccd4ac5369871d0ecb2b9c9a49d"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/a0f247d63489a107bbc3b712a77b302af2a2a173"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/bcd43ee1f25b682151df213c06a99b2e1c1cf2e5"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/e054dcd990d8180cde529ea28ce0838e76a5ad5e"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.