CVE-2026-99046

What it actually does

Memory leak of XSK buffers attached to buf_state objects in the gve driver RX path when the error bit is set in a completion descriptor for AF_XDP zero-copy mode.

Why it matters to the business

Gradual memory exhaustion on affected systems under sustained RX error conditions, leading to degraded network performance or denial of service in high-throughput environments.

How an attack unfolds

An attacker generates network traffic that causes the NIC to report error descriptors during RX completion processing; the driver fails to release the associated XSK buffer, accumulating unreclaimed memory over repeated triggers.

How to fix it

Apply the upstream kernel fix for the gve driver that properly frees XSK buffers on error descriptors; rebuild and deploy updated kernel packages across affected hosts.

How to confirm the fix worked

Confirm the presence of the buffer-freeing logic in the RX completion handler after the error-bit check; monitor for stable XSK buffer accounting under synthetic error injection; verify no net increase in leaked pages via slabinfo or kmemleak after load testing.

Typical attack path

1. Send crafted or malformed packets toward the target interface
2. Trigger RX completion descriptors with the error bit asserted
3. Observe progressive consumption of kernel memory without corresponding buffer release
4. Continue traffic pattern until memory pressure causes service degradation or crash

How to detect it

Monitor kernel slab allocator statistics and kmemleak reports for growth in gve-related XSK buffer objects; correlate spikes with RX completion error counters from ethtool or driver logs.

What your security team should do

• Prioritize kernel upgrades on systems using gve with AF_XDP zero-copy
• Enable memory usage alerting for gve-related slabs in production
• Review recent RX error rates on gve interfaces as an early indicator of exposure
• Test the fix in a lab environment that reproduces error-descriptor conditions before broad rollout