Executive brief
A vulnerability in the Linux kernel's Intel Ethernet drivers (e1000 and e1000e) can lead to memory leaks during network transmission errors. This issue occurs when the system fails to properly clean up memory mappings used for sending data over the network. Over time, this could degrade system performance or lead to a denial-of-service condition where the system becomes unresponsive due to exhausted resources.
Technical details
A logic error in the e1000 and e1000e drivers' TX mapping function results in a DMA mapping leak. When an error occurs while mapping transmit (TX) buffers, the driver attempts to unmap previously successful mappings for that socket buffer (skb). However, an off-by-one error in the cleanup loop—specifically decrementing the mapping count before entering the unmap loop—causes exactly one DMA mapping to be leaked if any prior mappings were successful. This is a regression from a previous fix for an infinite loop in the same component. The vulnerability is classified as CWE-401 (Missing Release of Memory after Effective Lifetime) and can be triggered by local users to cause resource exhaustion. Patches have been released across multiple stable kernel branches.
Affected products
- Linux Linux Kernel 2.6.33.1 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.78, 6.13 to 6.18.19, 6.19 to 6.19.9
Timeline
- 2026-02-24: other: Patch authored
- 2026-05-08: disclosed: CVE published
- 2026-05-21: advisory: NVD analysis completed
References
- https://git.kernel.org/stable/c/0606c24a745bafd1be5d66c48361638cd9cad74b
- https://git.kernel.org/stable/c/0a1fc25deabab4efce64610e3c449485c4fa8f5f
- https://git.kernel.org/stable/c/10b5e65959e955a1c8894e0a5413944b5a70204a
- https://git.kernel.org/stable/c/30e87ade8d678c25a8546cf38c0b498fa5cb27d3
- https://git.kernel.org/stable/c/519051c711dfd239ef6e4b28878efee400a035f9
- https://git.kernel.org/stable/c/7eaeb778bfaa3b2a804f89321c234d59c74569db
- https://git.kernel.org/stable/c/e94eaef11142b01f77bf8ba4d0b59720b7858109