CVE-2026-43102: Linux Kernel Memory Leak Vulnerability

CVE-2026-43102 Overview

CVE-2026-43102 is a memory leak vulnerability in the Linux kernel's Airoha network driver. The flaw resides in the airoha_qdma_rx_process() function within the QDMA receive path. When errors occur on subsequent buffers belonging to the non-linear part of an skb, the page_pool fragment is not linked to the skb and fails to return to the pool. This results in unreleased memory pages accumulating over time.

Kernel maintainers resolved the issue by partially reverting commit d6d2b0e1538d and ensuring page_pool_put_full_page always runs in the error path.

Critical Impact
Sustained packet processing errors on Airoha network interfaces can exhaust kernel memory, leading to degraded system performance or denial of service on affected devices.

Affected Products

Linux kernel versions containing commit d6d2b0e1538d introducing the page recycling change in airoha_qdma_rx_process()
Systems using the Airoha QDMA Ethernet driver (net/ethernet/airoha)
Embedded networking devices and routers based on Airoha SoCs

Discovery Timeline

2026-05-06 - CVE-2026-43102 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43102

Vulnerability Analysis

The vulnerability exists in the receive (RX) processing path of the Airoha QDMA Ethernet driver. The airoha_qdma_rx_process() function builds socket buffers (skb) from page_pool-backed fragments. When the driver constructs a non-linear skb from multiple page fragments, each fragment must either be attached to the skb or explicitly returned to the page_pool.

The defect occurs when errors arise while processing subsequent fragments of a multi-fragment packet. Examples include an invalid payload length reported by the network interface controller (NIC) or exhausting the available fragment slots for the skb. In these conditions, the page_pool fragment never gets linked to the skb, and the existing error path does not call page_pool_put_full_page for that fragment. The page leaks from the recycling pool.

Root Cause

The root cause traces to commit d6d2b0e1538d ("net: airoha: Fix page recycling in airoha_qdma_rx_process()"). That earlier change altered the error handling logic such that page_pool_put_full_page was no longer invoked unconditionally on error. The fix partially reverts that commit, restoring the unconditional release of the fragment back to the page_pool whenever the RX processing path fails. This classifies as a Memory Leak ([CWE-401]) in kernel space.

Attack Vector

The vulnerability triggers under error conditions during normal packet reception on Airoha hardware. An attacker on the local network capable of inducing malformed frames or unusual fragmentation patterns could repeatedly trigger the error path. Sustained triggering depletes the page_pool and consumes kernel memory. The vulnerability does not provide code execution or privilege escalation. The impact is limited to availability through resource exhaustion. See the Kernel Git Commit 285fa6b, Kernel Git Commit 4429b76, and Kernel Git Commit 7ee0063 for technical details of the fix.

Detection Methods for CVE-2026-43102

Indicators of Compromise

Steadily increasing kernel slab and page allocator usage on systems using the Airoha QDMA driver without corresponding workload growth
Elevated counters in /proc/net/page_pool reporting non-recycled pages tied to the Airoha receive queues
RX error counters incrementing on Airoha interfaces shown via ethtool -S <iface>

Detection Strategies

Audit running kernel versions to identify builds that include commit d6d2b0e1538d but lack the fix commits referenced in the advisory
Monitor long-term memory utilization trends on networking appliances and embedded Linux devices using Airoha SoCs
Correlate RX error spikes with reductions in available kernel memory to detect leak conditions

Monitoring Recommendations

Collect MemAvailable, Slab, and page_pool statistics through telemetry agents and alert on sustained downward trends
Track dmesg for page_pool warnings or airoha driver errors emitted during RX processing
Establish baselines for kernel memory usage on Airoha-based devices to detect deviations indicative of resource exhaustion

How to Mitigate CVE-2026-43102

Immediate Actions Required

Identify all Linux systems running the Airoha QDMA Ethernet driver and inventory their kernel versions
Apply the upstream fix commits from kernel.org to the impacted stable branches as soon as builds are available from your distribution or vendor
Reboot affected devices after patching to clear any leaked pages from the running kernel

Patch Information

The fix is committed upstream and available in the stable Linux kernel trees. Refer to Kernel Git Commit 285fa6b, Kernel Git Commit 4429b76, and Kernel Git Commit 7ee0063. The fix ensures page_pool_put_full_page always runs in the airoha_qdma_rx_process() error path, preventing fragment leaks.

Workarounds

Schedule periodic reboots of affected devices to reclaim leaked memory until patches can be deployed
Reduce exposure to malformed traffic by enforcing upstream filtering on managed network segments
Monitor kernel memory usage and proactively restart networking services if leak indicators appear

bash

# Verify running kernel version and check for the Airoha driver
uname -r
lsmod | grep airoha

# Inspect page_pool statistics for non-recycled pages
cat /proc/net/page_pool/* 2>/dev/null

# Inspect RX error counters on the Airoha interface
ethtool -S <iface> | grep -iE 'rx_err|drop'