CVE-2026-99028

In the Linux kernel, the following vulnerability has been resolved:

net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop

In the dmaengine path the driver pre-submits RX buffers and holds in-flight TX buffers whose SKBs are DMA-mapped by the driver and freed only in the completion callbacks. On ndo stop() dmaengine terminate sync() aborts these descriptors without running their callbacks, and the driver then frees only the ring shells, leaking every SKB still owned by the engine and its DMA mapping on each ifdown. With 128 RX buffers pre-posted per channel, the mapping leak can eventually exhaust a limited IOMMU aperture.

Clear the slot's skb in the TX and RX callbacks so a non-NULL skb marks a slot that still owns a live, DMA-mapped buffer, and on stop unmap and free every such buffer.

axienet dma rx cb() runs from the DMA tasklet and re-arms the RX ring on each completion, so it can race axienet stop(): a completion may submit a fresh buffer after dmaengine terminate sync() has returned, leaving the channel armed with a buffer the teardown then frees while the engine may still write into it (dma release channel() does not stop it either). Add a lock that axienet dma rx cb() holds across the @stopping check and the resubmit, and axienet stop() holds to set @stopping before terminating. Once @stopping is set no callback can arm a new buffer, and any armed just before is aborted by the terminate, so teardown only frees buffers the engine no longer owns.