CVE-2026-68135

In the Linux kernel, the following vulnerability has been resolved: net: hip04: fix RX buffer leak on build_skb failure When build_skb() fails in hip04_rx_poll(), the driver jumps to the refill path without releasing the current RX buffer and its DMA mapping. Installing a replacement buffer then overwrites the slot references and leaks both resources. Keep the current slot intact and return budget so NAPI retries the same buffer. Also free a newly allocated RX fragment when dma_map_single() fails. This issue was found by an in-house static analysis tool.

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/14fa65d10f5696b063a7d8d26e8291ea84a2c6ed
https://git.kernel.org/stable/c/2b19fe277645fd1aeb18fd4ecdcf31966080dee7
https://git.kernel.org/stable/c/67a7614bde310da006ab259f4f163d3fb0f9e253
https://git.kernel.org/stable/c/690ecc13a4032e5cae1dc6659512f32b033533b0
https://git.kernel.org/stable/c/80d977f280b4eccd4ac5369871d0ecb2b9c9a49d
https://git.kernel.org/stable/c/a0f247d63489a107bbc3b712a77b302af2a2a173
https://git.kernel.org/stable/c/bcd43ee1f25b682151df213c06a99b2e1c1cf2e5
https://git.kernel.org/stable/c/e054dcd990d8180cde529ea28ce0838e76a5ad5e

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-10 13:19

Updated : 2026-08-19 17:20

NVD link : CVE-2026-68135

Mitre link : CVE-2026-68135

CVE.ORG link : CVE-2026-68135

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-68135", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "701a0fd5231866db08cebcd502894699f49cb960", "lessThan": "690ecc13a4032e5cae1dc6659512f32b033533b0", "versionType": "git"}, {"status": "affected", "version": "701a0fd5231866db08cebcd502894699f49cb960", "lessThan": "2b19fe277645fd1aeb18fd4ecdcf31966080dee7", "versionType": "git"}, {"status": "affected", "version": "701a0fd5231866db08cebcd502894699f49cb960", "lessThan": "bcd43ee1f25b682151df213c06a99b2e1c1cf2e5", "versionType": "git"}, {"status": "affected", "version": "701a0fd5231866db08cebcd502894699f49cb960", "lessThan": "e054dcd990d8180cde529ea28ce0838e76a5ad5e", "versionType": "git"}, {"status": "affected", "version": "701a0fd5231866db08cebcd502894699f49cb960", "lessThan": "67a7614bde310da006ab259f4f163d3fb0f9e253", "versionType": "git"}, {"status": "affected", "version": "701a0fd5231866db08cebcd502894699f49cb960", "lessThan": "80d977f280b4eccd4ac5369871d0ecb2b9c9a49d", "versionType": "git"}, {"status": "affected", "version": "701a0fd5231866db08cebcd502894699f49cb960", "lessThan": "a0f247d63489a107bbc3b712a77b302af2a2a173", "versionType": "git"}, {"status": "affected", "version": "701a0fd5231866db08cebcd502894699f49cb960", "lessThan": "14fa65d10f5696b063a7d8d26e8291ea84a2c6ed", "versionType": "git"}], "programFiles": ["drivers/net/ethernet/hisilicon/hip04_eth.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.5"}, {"status": "unaffected", "version": "0", "lessThan": "4.5", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.265", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.216", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.183", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.148", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.101", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.42", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.6", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/hisilicon/hip04_eth.c"], "defaultStatus": "affected"}]}], "published": "2026-08-10T13:19:58.990", "references": [{"url": "https://git.kernel.org/stable/c/14fa65d10f5696b063a7d8d26e8291ea84a2c6ed", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/2b19fe277645fd1aeb18fd4ecdcf31966080dee7", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/67a7614bde310da006ab259f4f163d3fb0f9e253", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/690ecc13a4032e5cae1dc6659512f32b033533b0", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/80d977f280b4eccd4ac5369871d0ecb2b9c9a49d", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a0f247d63489a107bbc3b712a77b302af2a2a173", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/bcd43ee1f25b682151df213c06a99b2e1c1cf2e5", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/e054dcd990d8180cde529ea28ce0838e76a5ad5e", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hip04: fix RX buffer leak on build_skb failure\n\nWhen build_skb() fails in hip04_rx_poll(), the driver jumps to the\nrefill path without releasing the current RX buffer and its DMA mapping.\nInstalling a replacement buffer then overwrites the slot references and\nleaks both resources.\n\nKeep the current slot intact and return budget so NAPI retries the same\nbuffer. Also free a newly allocated RX fragment when dma_map_single()\nfails.\n\nThis issue was found by an in-house static analysis tool."}], "lastModified": "2026-08-19T17:20:30.757", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}