CVE-2026-97955
Received Received - Intake

Memory Corruption in Linux Kernel XDP Program Handling

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: mana: restore the XDP program pointer when pre-allocation fails mana_xdp_set() publishes the new program into apc->bpf_prog before it allocates anything, because mana_pre_alloc_rxbufs() sizes the buffers from it via mana_get_rxbuf_cfg(). When that allocation fails the function returns the error directly, skipping the err_dealloc_rxbuffs label which is the only place that restores the previous pointer. The attach is reported as failed, so the BPF core drops the reference it held for the caller and the program can be freed, while apc->bpf_prog still points at it. The next consumer of mana_xdp_get() - typically mana_chn_setxdp() from mana_alloc_queues() on the following ifup, or after a TX timeout reset - then calls bpf_prog_add() on freed memory. This is reachable from an ordinary "ip link set dev ethX xdp obj ..." whenever the per-queue RX buffer pre-allocation cannot be satisfied. Restore the previous program on that error path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-10-15
AI Q&A
2026-09-25
EPSS Evaluated
2026-10-14
NVD
CVE-2026-97955
EUVD
EUVD-2026-86809

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a use-after-free issue in the mana network driver. When setting an XDP program, the function mana_xdp_set() updates a pointer to the new program before allocating resources. If allocation fails, the function exits without restoring the previous program pointer. This leaves a dangling pointer to freed memory, which can later cause a crash or corruption when another part of the driver tries to use it.

Detection Guidance

This vulnerability is specific to the Linux kernel's mana network driver and may not have direct detection commands. Monitor kernel logs for XDP-related errors or crashes, especially after running 'ip link set dev ethX xdp obj ...' commands. Check for failed buffer allocations or BPF program issues in dmesg output.

Impact Analysis

An attacker with local access could exploit this to crash the system or execute arbitrary code with kernel privileges. This could lead to denial of service, data corruption, or unauthorized access depending on the attacker's goals and system configuration.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel memory management issue in the mana network driver that could lead to use-after-free scenarios, but no evidence suggests it impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-97955. Avoid using XDP programs on mana network interfaces until the kernel is updated. If XDP is required, consider using alternative network drivers until the patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97955. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart