CVE-2026-99028 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel security, especially those managing systems utilizing the xilinx axienet driver, should be aware of this vulnerability and prioritize patching to prevent potential memory leaks and IOMMU aperture exhaustion.

Why it matters

CVE-2026-99028 is a Linux kernel vulnerability in the xilinx axienet driver that can lead to a DMA buffer leak on dmaengine stop. Defenders should prioritize patching, review system configurations, and monitor for potential memory leak issues.

• Memory leak potentially exhausting IOMMU aperture.
• Potential for system instability due to memory leak.
• Need for patching to prevent exploitation.
• Verification of system configurations and driver updates required.

Technical summary

The Linux kernel vulnerability CVE-2026-99028 is related to the xilinx axienet driver's handling of DMA buffers during the dmaengine stop operation. The driver pre-submits RX buffers and holds in-flight TX buffers, which are not properly freed during the dmaengine stop operation, potentially leading to a memory leak that can exhaust a limited IOMMU aperture. Defenders should prioritize patching this vulnerability, especially in systems utilizing the xilinx axienet driver, to prevent potential memory leaks and IOMMU aperture exhaustion. The vulnerability can lead to system instability due to memory leaks, emphasizing the need for prompt patching and verification of system configurations.

Defensive priority

Defenders should prioritize patching this vulnerability, especially in systems utilizing the xilinx axienet driver, to prevent potential memory leaks and IOMMU aperture exhaustion.

Recommended defensive actions

• Patch the Linux kernel with the relevant commit to fix the vulnerability.
• Review system configurations and ensure the xilinx axienet driver is properly updated.
• Monitor system logs for potential memory leak issues related to the xilinx axienet driver.
• Perform a thorough review of system configurations to ensure the xilinx axienet driver is properly updated and secured.
• Implement compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the vulnerability in the Linux kernel's xilinx axienet driver. The issue is related to the handling of DMA buffers during the dmaengine stop operation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.