{"cve":"CVE-2026-99057","nvd":{"published":"2026-10-23T13:17:29.373","modified":"2026-10-23T13:17:29.373","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nxen/netfront: don't leak the skb when xennet_fill_frags() fails\n\nWhen a response chain has more slots than fit in the skb's frags,\nxennet_fill_frags() returns an error and xennet_poll() jumps to its\nerror path.  That path moves what's left on tmpq to errq to be freed,\nbut the skb being filled was already dequeued from tmpq, so it's never\nfreed.  Each chain that overflows leaks the skb and the pages attached\nto it as frags, and the backend decides how many slots it sends.\n\nPut the skb back on tmpq before taking the error path, like the\nxennet_set_skb_gso() failure just above it does.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/086944c1c2cbb683543bc3ff08637847b03c8009","https://git.kernel.org/stable/c/5051df031144753d3e18862514969146b601d089","https://git.kernel.org/stable/c/84e3ea6502b5f14ce8d499d0b6e0e38386274cf0","https://git.kernel.org/stable/c/93ccaf1c26e2133396173b76a071e59024daa622","https://git.kernel.org/stable/c/99011a11c97340ef7290df7dc199305c73fab2f2"],"products":[],"source":"nvd","synced_at":"2026-10-23T16:39:28.036610720+00:00"},"epss":{"cve":"CVE-2026-99057","score":0.00176,"percentile":0.07064,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}