CVE-2026-99078

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry

With AF XDP on a striding RQ, mlx5e defers releasing XSK buffers until an MPWQE is refilled. If XSK allocation then returns -ENOMEM, actual wq head is not advanced and a later NAPI poll retries the same WQE.

mlx5e free rx mpwqe() leaves each released slot marked as releasable. On retry it can therefore call xsk buff free() again through stale pointers after the frames have returned to the XSK pool and been reallocated.

Set all skip release bitmap bits in the common error path of mlx5e xsk alloc rx mpwqe(). This matches mlx5e alloc rx mpwqe(). A successful allocation already clears the bitmap after replacing every buffer, so retries become idempotent without changing the success path.

Fault injection forced three consecutive failures for one selected MPWQE. Both an early allocation failure and a partial 8-of-16-buffer unwind released the original 16 XSK buffers only once. Each error left a full bitmap, the following NAPI retry skipped the release, and a later successful allocation cleared it. A 20-second AF XDP zero-copy pressure run exercised 1,575,262 buffer allocation failures without invalid descriptors, WQE errors, or kernel warnings.