CVE-2026-53229: Linux Kernel mlx5e XSK DMA and Frame Leak DoS

Technical summary

The vulnerability resides in mlx5e_xmit_xdp_buff() within the XSK branch of the mlx5e driver. When xdp_convert_zc_to_xdp_frame() allocates an xdp_frame and dma_map_phys() maps its DMA address, but sq->xmit_xdp_frame() subsequently returns false (e.g., transmit queue saturation), the function exits without performing cleanup. The xdpi_fifo push—which would queue entries for the completion handler to process—only occurs on successful transmission, leaving leaked DMA mappings and frame allocations orphaned. This is a resource exhaustion vulnerability classified under CWE-401 (Missing Release of Memory after Effective Lifetime). The fix adds the missing dma_unmap_phys() and xdp_return_frame() calls to mirror the cleanup logic already present in mlx5e_xdp_xmit().

Business impact

This vulnerability causes gradual resource exhaustion on systems running Mellanox network adapters under sustained XDP_TX workloads. Each failed transmission accumulates a DMA leak; with heavy packet processing, leak counts can reach thousands. The result is memory pressure, potential out-of-memory conditions, and driver instability. In production environments relying on high-performance AF_XDP packet processing (common in NFV, edge computing, and load-balancing deployments), this degradation can trigger service interruptions or force unplanned driver reloads, impacting network availability.

Affected systems

The vulnerability affects the Linux kernel across multiple stable and development versions. It impacts any system running the mlx5e driver (Mellanox ConnectX-3/4/5/6 series adapters) with AF_XDP socket support enabled and active XDP_TX operations. Systems explicitly monitoring DMA allocations (CONFIG_DMA_API_DEBUG=y) will surface the leak immediately; without this debug flag, the leak remains silent until resource exhaustion occurs.

Exploitability

No known public exploits exist for this vulnerability (KEV status: not added). Exploitation is not straightforward in the traditional sense—there is no remote code execution or privilege escalation vector. However, an unprivileged user with XDP socket creation privileges can trigger sustained leaked allocations by programming XDP_TX operations that intentionally cause queue saturation. This could be weaponized for denial-of-service in multi-tenant environments. The vulnerability requires active malicious or misconfigured workload interaction to manifest; it is not triggered by passive traffic.

Remediation

Apply the kernel patch that adds dma_unmap_phys() and xdp_return_frame() calls to the error path in mlx5e_xmit_xdp_buff(). This ensures DMA mappings are released and frame buffers are returned to the pool when transmission fails. Verify the patch against the official Linux kernel repository and your vendor's security advisories for the specific kernel version in use. Patched kernels will resolve the resource leak immediately; no configuration changes are required.

Patch guidance

Consult your Linux distribution's kernel security advisories for patched versions of your active kernel series. For Red Hat Enterprise Linux, Ubuntu, Debian, and other major distributions, check their respective kernel update packages released after CVE-2026-53229 disclosure. The fix is minimal and stable; kernel module recompilation may be necessary if you maintain out-of-tree driver builds. After patching, validate AF_XDP functionality with existing workloads and monitor DMA allocation warnings (if CONFIG_DMA_API_DEBUG is enabled) to confirm resolution.

Detection guidance

Enable CONFIG_DMA_API_DEBUG in your kernel build or runtime configuration (if supported) to surface DMA leaks on driver events. Monitor for DMA-API warnings in kernel logs, particularly on driver unbind or system shutdown. In production, track memory pressure and query /proc/meminfo and DMA pool statistics during sustained XDP workloads. Correlate memory growth with XDP_TX packet drops or queue full conditions to identify the vulnerability in action. Packet capture and analysis of XDP program behavior (via bpftrace or perf) can reveal patterns of transmission failures that precede leaks.

Why prioritize this

This vulnerability scores HIGH (CVSS 7.5) due to its availability impact and ease of triggering via network input under AF_XDP conditions. While not remotely exploitable in the traditional sense, the denial-of-service impact is material in production networks. Patches are low-risk and should be applied as part of routine kernel security updates. Prioritize systems running Mellanox adapters with active XDP workloads in latency-sensitive or multi-tenant environments.

Risk score, explained

CVSS 7.5 reflects the High severity: Attack Vector Network (XDP_TX can be triggered by ingress packets), Attack Complexity Low (no special conditions), Privileges Not Required (unprivileged users can create XDP sockets in many configurations), User Interaction None, Scope Unchanged, and Availability High impact (memory exhaustion and service disruption). Confidentiality and Integrity are unaffected. The score does not account for the fact that XDP socket creation may require elevated privileges in some deployments, which would lower practical exploitability; however, the CVSS reflects the vulnerability's inherent reachability and effect.

Frequently asked questions