Executive brief
The Linux kernel's Elastic Network Adapter (ENA) driver for AWS network interfaces has a resource leak when regular transmit queue setup fails after XDP (eXpress Data Path) queues are created. If queue initialization encounters an error, the XDP queues are not properly cleaned up, wasting system memory and device resources. This can occur during network adapter initialization, potentially leaving the system in an unstable state.
Technical details
The vulnerability is a resource leak in the ENA driver's queue creation logic. The create_queues_with_size_backoff() function creates XDP TX queues before setting up regular TX queues; however, if the subsequent ena_setup_tx_resources_in_range() or ena_create_io_tx_queues_in_range() calls fail, the error handling paths fail to call ena_destroy_xdp_tx_queues() and related cleanup functions. This leaves allocated queue structures in memory. The fix adds explicit XDP queue teardown at the two failure points where regular TX setup fails. The bug was identified through static analysis on kernel v6.13-rc1 and confirmed present in v7.1-rc7; a patch was applied to the stable kernel tree in June 2026.
Affected products
- Linux Linux kernel v6.13-rc1 through v7.1-rc7 and later (prior to fix)
Timeline
- 2026-06-16: disclosed: Patch authored by Dawei Feng
- 2026-06-18: patched: Patch merged upstream
- 2026-07-24: patched: Patch released in stable kernel tree