CVE-2026-53215
published 2026-06-25CVE-2026-53215: In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current…
PriorityP350critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.55%
42.0th percentile
In the Linux kernel, the following vulnerability has been resolved:
net: mvpp2: refill RX buffers before XDP or skb use
The RX error path returns the current descriptor buffer to the hardware
BM pool. That is only valid while the driver still owns the buffer.
mvpp2_rx_refill() can fail after the current buffer has been handed to
XDP or attached to an skb. In those cases mvpp2_run_xdp() may have
recycled, redirected, or queued the page for XDP_TX, and an skb free also
retires the data buffer. Returning such a buffer to BM lets hardware DMA
into memory that is no longer owned by the RX ring.
Refill the BM pool before handing the current buffer to XDP or to the
skb. If the allocation fails there, drop the packet and return the
still-owned current buffer to BM, preserving the pool depth. Once the
refill succeeds, later local drops retire/free the current buffer instead
of returning it to BM.
Affected
26 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 07dd0a7aae7f72af7cec18909581c2bb570edddc < a88b3293b556f4d8fba11db9a8061a6b0d3b69e6 | a88b3293b556f4d8fba11db9a8061a6b0d3b69e6 |
| linux | linux | >= 07dd0a7aae7f72af7cec18909581c2bb570edddc < a03cdcedb2cbcc42551dc3e4746929e93c5352d5 | a03cdcedb2cbcc42551dc3e4746929e93c5352d5 |
| linux | linux | >= 07dd0a7aae7f72af7cec18909581c2bb570edddc < 580f92f27cb8724bcc4be98ee89890eab524a2ae | 580f92f27cb8724bcc4be98ee89890eab524a2ae |
| linux | linux | >= 07dd0a7aae7f72af7cec18909581c2bb570edddc < d0c8c4fbd22d260fe28530260656c5fb3c20ce84 | d0c8c4fbd22d260fe28530260656c5fb3c20ce84 |
| linux | linux | >= 07dd0a7aae7f72af7cec18909581c2bb570edddc < 8a2126c5afe89f8ceeb60a3afb9f075b736194cd | 8a2126c5afe89f8ceeb60a3afb9f075b736194cd |
| linux | linux | >= 07dd0a7aae7f72af7cec18909581c2bb570edddc < 02e1b5c4d3b4c658b72c145427cded1bba613fc1 | 02e1b5c4d3b4c658b72c145427cded1bba613fc1 |
| linux | linux | >= 07dd0a7aae7f72af7cec18909581c2bb570edddc < 5e8e2a9624df72fca7c736b2966b2cbf6c9c3ff6 | 5e8e2a9624df72fca7c736b2966b2cbf6c9c3ff6 |
| linux | linux | >= 5.7.15 < 5.8 | 5.8 |
| linux | linux | >= 5.8.2 < 5.9 | 5.9 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 5.16 < 6.1.176 | 6.1.176 |
| linux | linux_kernel | >= 5.7.15 < 5.8 | 5.8 |
| linux | linux_kernel | >= 5.8.2 < 5.15.210 | 5.15.210 |
| linux | linux_kernel | >= 6.13 < 6.18.36 | 6.18.36 |
| linux | linux_kernel | >= 6.19 < 7.0.13 | 7.0.13 |
| linux | linux_kernel | >= 6.2 < 6.6.143 | 6.6.143 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM poo
ghsa_unreviewed·2026-06-25
CVE-2026-53215 In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM poo
In the Linux kernel, the following vulnerability has been resolved:
net: mvpp2: refill RX buffers before XDP or skb use
The RX error path returns the current descriptor buffer to the hardware
BM pool. That is only valid while the driver still owns the buffer.
mvpp2_rx_refill() can fail after the current buffer has been handed to
XDP or attached to an skb. In those cases mvpp2_run_xdp() may have
recycled, redirected, or queued the page for XDP_TX, and an skb free also
retires the data buffer. Returning such a buffer to BM lets hardware DMA
into memory that is no longer owned by the RX ring.
Refill the BM pool before handing the current buffer to XDP or to the
skb. If the allocation fails there, drop the packet and return the
still-owned current buffer to BM, preserving the pool depth. O
Red Hat
kernel: net: mvpp2: refill RX buffers before XDP or skb use
vendor_redhat·2026-06-25
CVE-2026-53215 CWE-763 kernel: net: mvpp2: refill RX buffers before XDP or skb use
kernel: net: mvpp2: refill RX buffers before XDP or skb use
A flaw was found in the Linux kernel's mvpp2 network driver. This vulnerability occurs due to incorrect handling of receive (RX) buffers, where a buffer is returned to the hardware Buffer Manager (BM) pool after it has been passed to the eXpress Data Path (XDP) or attached to a socket buffer (skb). This allows hardware Direct Memory Access (DMA) operations into memory that is no longer controlled by the RX ring, potentially leading to memory corruption.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterpr
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/02e1b5c4d3b4c658b72c145427cded1bba613fc1https://git.kernel.org/stable/c/580f92f27cb8724bcc4be98ee89890eab524a2aehttps://git.kernel.org/stable/c/5e8e2a9624df72fca7c736b2966b2cbf6c9c3ff6https://git.kernel.org/stable/c/8a2126c5afe89f8ceeb60a3afb9f075b736194cdhttps://git.kernel.org/stable/c/a03cdcedb2cbcc42551dc3e4746929e93c5352d5https://git.kernel.org/stable/c/a88b3293b556f4d8fba11db9a8061a6b0d3b69e6https://git.kernel.org/stable/c/d0c8c4fbd22d260fe28530260656c5fb3c20ce84
2026-06-25
Published