# CVE-2026-99028: net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop


- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Fix available:** Yes
- **Published:** 23 Oct 2026
- **Updated:** 23 Oct 2026
- **Also known as:** BELL-CVE-2026-99028, DEBIAN-CVE-2026-99028, GHSA-5xgg-2g43-r4gh, UBUNTU-CVE-2026-99028

## What is CVE-2026-99028?

CVE-2026-99028 is a vulnerability in Linux, published on 23 Oct 2026. 

### Official description

In the Linux kernel, the following vulnerability has been resolved:

net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop

In the dmaengine path the driver pre-submits RX buffers and holds
in-flight TX buffers whose SKBs are DMA-mapped by the driver and freed
only in the completion callbacks. On ndo_stop() dmaengine_terminate_sync()
aborts these descriptors without running their callbacks, and the driver
then frees only the ring shells, leaking every SKB still owned by the
engine and its DMA mapping on each ifdown. With 128 RX buffers pre-posted
per channel, the mapping leak can eventually exhaust a limited IOMMU
aperture.

Clear the slot's skb in the TX and RX callbacks so a non-NULL skb marks a
slot that still owns a live, DMA-mapped buffer, and on stop unmap and free
every such buffer.

axienet_dma_rx_cb() runs from the DMA tasklet and re-arms the RX ring on
each completion, so it can race axienet_stop(): a completion may submit a
fresh buffer after dmaengine_terminate_sync() has returned, leaving the
channel armed with a buffer the teardown then frees while the engine may
still write into it (dma_release_channel() does not stop it either). Add a
lock that axienet_dma_rx_cb() holds across the @stopping check and the
resubmit, and axienet_stop() holds to set @stopping before terminating.
Once @stopping is set no callback can arm a new buffer, and any armed just
before is aborted by the terminate, so teardown only frees buffers the
engine no longer owns.

## Which versions are affected by CVE-2026-99028?


## How do I fix CVE-2026-99028?

Upgrade to a fixed version.

## Is CVE-2026-99028 being exploited?

There is no known exploitation of CVE-2026-99028 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-99028 and fix it if it is affected.

What it is: CVE-2026-99028 is a vulnerability in Linux, published on 23 Oct 2026. 
Exploitation: There is no known exploitation of CVE-2026-99028 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-99028/ (Markdown: https://insights.sbomify.com/CVE-2026-99028/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-99028
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-99028
- OSV: https://osv.dev/vulnerability/CVE-2026-99028

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-99028/
Summaries are generated and may contain mistakes; the official description above is the record.