Vulnerability feed

Executive summary

A bug in the Linux kernel's Xen network frontend driver (netfront) can leak memory when a received packet has more fragments than fit in its buffer. The advisory does not state a severity score or how an attacker could trigger it, and the fix is a kernel patch that the stable tree has applied.

Technical summary

The flaw is a resource leak (memory leak) in the xen/netfront driver. When xennet_fill_frags() fails because a response chain has more slots than the skb's frags can hold, xennet_poll() takes its error path, but the skb was already removed from the temporary queue and was never freed, so the skb and its attached pages leak for each overflowing chain. The advisory says the backend decides how many slots it sends, which suggests a backend-driven trigger, but it does not state an explicit attack vector or privileges required. The fix puts the skb back on tmpq before the error path, and it is tagged Fixes ad4f15dc2c70 and Cc stable. The advisory does not state a CVSS score, affected or fixed kernel version numbers, workarounds, or any detection guidance, and it does not say whether exploitation has occurred.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/086944c1c2cbb68…c3ff08637847b03c8009

Score

No CVSS score published.

Affects

LinuxXenLinuxLinux kernelXen netfront