Cloudanix VulnDB

CVE-2026-98486

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A small mistake in error handling inside a network driver can leave memory allocated when something goes wrong during startup, slowly using up resources on certain Linux servers until performance suffers.

Exploitation
Other
Attacker needs
Local User
Complexity
Theoretical
Impact
Denial Of Service
Component
OS kernel
Class
Other
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Memory leak of a coherent DMA buffer allocated during ena_device_init() when ena_probe() fails afterward, because the error path omits the call to ena_com_mmio_reg_read_request_destroy().

Why it matters to the business

Repeated driver probe failures on systems using Amazon ENA networking can gradually exhaust DMA memory resources, leading to performance degradation or eventual denial of service on affected Linux hosts.

How an attack unfolds

An attacker with local access or the ability to trigger repeated device probe failures (for example via crafted hardware events or driver reload loops) can cause the kernel to leak DMA buffers without ever freeing them, eventually exhausting memory.

How to fix it

Apply the upstream kernel patch that adds the missing ena_com_mmio_reg_read_request_destroy() call in the ena_probe() error path; rebuild and deploy the fixed kernel image to all affected systems.

How to confirm the fix worked

Confirm the patch is present by inspecting the ena_probe() error handling code for the destroy call; test by forcing probe failures and verifying no DMA buffer leaks via kernel memory accounting tools.

Typical attack path

  1. Trigger conditions that cause ena_probe() to fail after successful ena_device_init()
  2. Repeat the failure scenario to accumulate leaked coherent DMA buffers
  3. Observe gradual depletion of DMA memory leading to system instability

How to detect it

Review kernel logs for repeated ENA probe failures; use memory leak detection tools or DMA allocation counters to identify accumulating buffers from the ENA MMIO read path.

What your security team should do

  • Prioritize kernel updates on all systems using the ENA driver within normal change windows
  • Monitor for unusual DMA memory consumption on ENA-enabled instances
  • Include the fix in all future kernel builds and deployment pipelines

The record

In the Linux kernel, the following vulnerability has been resolved: net: ena: fix MMIO read buffer leak on probe failure ena_device_init() initializes the MMIO read mechanism with ena_com_mmio_reg_read_request_init(), which allocates a coherent DMA buffer for MMIO read responses. The normal removal path releases this buffer through ena_com_mmio_reg_read_request_destroy(). However, if ena_probe() fails after ena_device_init() succeeds, the error path destroys the admin resources and eventually frees ena_dev without destroying the MMIO read request, leaving the coherent DMA buffer allocated. Call ena_com_mmio_reg_read_request_destroy() in the probe error path before releasing the remaining device resources. This issue was found by manual code inspection.

Affected packages

Ecosystem Package Introduced Fixed