Executive brief
The HiSilicon hip04 Ethernet driver has a memory leak in its receive packet handling code. When the kernel fails to allocate a packet buffer structure, the driver improperly discards the associated DMA memory mapping without releasing it, causing those resources to become unreachable. This can gradually exhaust system memory and degrade network performance over time.
Technical details
The vulnerability is a resource leak in the hip04_rx_poll() function of drivers/net/ethernet/hisilicon/hip04_eth.c. When build_skb() fails, the code incorrectly jumps to a refill path that overwrites RX buffer slot references without releasing the current buffer and its DMA mapping, causing a leak of both the kernel buffer and DMA-mapped memory. Additionally, if dma_map_single() fails during buffer allocation, a newly allocated RX fragment was not freed. The fix retains the current slot and returns budget to allow NAPI to retry the same buffer, and adds a call to skb_free_frag() when DMA mapping fails. No authentication or user interaction is required; the leak occurs in normal driver operation during packet reception.
Affected products
- Linux Linux kernel multiple versions (see stable tree branches)
Timeline
- 2026-08-10: disclosed
- 2026-07-22: patched: Commit 14fa65d10f5696b063a7d8d26e8291ea84a2c6ed merged upstream