Is CVE-2026-99047 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-99047 being exploited in the wild.

How severe is CVE-2026-99047?

Informational severity, published 23 October 2026.

Which products and versions are affected?

Unknown Linux kernel versions with c1fffc5d66a7 (GVE AF_XDP support) through before fix commit 73670ddb91a4d22e1deb3efd962242de1ec48e90.

Is there a fix for CVE-2026-99047?

A patch was published on 2026-10-05: upstream commit 73670ddb91a4d22e1deb3efd962242de1ec48e90 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-99047 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-99047?

Check whether you run Unknown Linux kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-99047: Linux kernel GVE XSK buffer memory leak when stopping rings

CVE-2026-99047 · Severity: info · Published 2026-10-23

The Linux kernel's Google Virtual Ethernet (GVE) driver has a memory leak that fails to release XSK buffers when network rings are stopped. This leak can cause all posted XSK buffers to be retained in memory, degrading system performance and potentially causing resource exhaustion on systems using AF_XDP zero-copy networking.

Technologies: Unknown Linux kernel. Vendors: Unknown.

Quick answers

Is CVE-2026-99047 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-99047 being exploited in the wild.
How severe is CVE-2026-99047?: Informational severity, published 23 October 2026.
Which products and versions are affected?: Unknown Linux kernel versions with c1fffc5d66a7 (GVE AF_XDP support) through before fix commit 73670ddb91a4d22e1deb3efd962242de1ec48e90.
Is there a fix for CVE-2026-99047?: A patch was published on 2026-10-05: upstream commit 73670ddb91a4d22e1deb3efd962242de1ec48e90 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-99047 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-99047?: Check whether you run Unknown Linux kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The GVE driver does not free XSK (Express Shared Buffer/AF_XDP) buffers attached to allocated buf_state structures during the gve_rx_reset_ring_dqo() function when stopping rings. The fix adds explicit cleanup code to call xsk_buff_free() on attached buffers before nullifying the pointer, preventing memory leaks in the DQO RX datapath for AF_XDP zero-copy mode.

Affected products

<UNKNOWN> Linux kernel versions with c1fffc5d66a7 (GVE AF_XDP support) through before fix commit 73670ddb91a4d22e1deb3efd962242de1ec48e90

Timeline

2026-10-23: disclosed
2026-10-05: patched: upstream commit 73670ddb91a4d22e1deb3efd962242de1ec48e90

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.