CVE-2026-68135: Linux Kernel hip04 DoS Vulnerability

CVE-2026-68135 Overview

CVE-2026-68135 is a memory leak vulnerability in the Linux kernel's hip04 Ethernet network driver. The flaw resides in the hip04_rx_poll() receive path, where a failure of build_skb() causes the driver to jump to the refill path without releasing the current RX buffer and its DMA mapping. Installing a replacement buffer then overwrites the slot references, leaking both the RX buffer and its DMA mapping. The issue was identified through an in-house static analysis tool and resolved via upstream kernel commits.

Critical Impact
Repeated build_skb() failures under memory pressure progressively exhaust kernel memory and DMA-mappable resources on systems using the HiSilicon hip04 Ethernet controller, potentially resulting in a denial of service.

Affected Products

Linux kernel builds including the hip04 Ethernet driver (drivers/net/ethernet/hisilicon/hip04_eth.c)
HiSilicon SoC platforms using the hip04 Ethernet MAC
Stable kernel branches referenced by the upstream fix commits

Discovery Timeline

2026-08-10 - CVE-2026-68135 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68135

Vulnerability Analysis

The hip04 driver services received frames inside its NAPI poll routine hip04_rx_poll(). For each descriptor, the driver unmaps the DMA region, calls build_skb() to wrap the buffer in an sk_buff, and then allocates a fresh page fragment for the descriptor slot. When build_skb() returns NULL, the original code path branches directly to the buffer refill logic. This branch does not free the just-consumed RX buffer, nor does it unmap the associated DMA mapping. The subsequent refill overwrites the slot's buffer pointer and DMA handle with references to the newly allocated fragment, permanently losing the references needed to release the original resources.

A secondary defect exists in the refill path itself: when dma_map_single() fails on the freshly allocated fragment, the fragment is not freed, producing an additional leak. Both issues are classic resource-management errors on the error-handling path [CWE-401].

Root Cause

The root cause is missing cleanup on the error branch inside hip04_rx_poll(). The upstream fix keeps the current descriptor slot intact when build_skb() fails and returns the current NAPI budget so the framework retries the same buffer on the next poll. It also frees the newly allocated RX fragment when dma_map_single() fails.

Attack Vector

The defect is triggered by conditions that make build_skb() or dma_map_single() fail, typically low-memory or fragmented-memory states on the host. An attacker with the ability to sustain high traffic to a vulnerable interface can accelerate memory pressure and amplify the leak rate. No authentication is required for network-adjacent traffic reception, but exploitation requires the target to run an affected kernel on hip04 hardware. See the upstream fix commits: kernel.org commit 14fa65d, commit 67a7614, commit 80d977f, commit a0f247d, and commit e054dcd.

// No verified exploit code is published for this issue.
// Refer to upstream commits for the patched hip04_rx_poll() logic.

Detection Methods for CVE-2026-68135

Indicators of Compromise

Steady, unexplained growth in kernel Slab and DMA memory accounting on hip04-based systems under sustained network load.
build_skb() or dma_map_single() failure messages in dmesg correlated with rising RX errors on the hip04 interface.
Progressive throughput degradation or NETDEV WATCHDOG timeouts on the affected Ethernet interface.

Detection Strategies

Inventory kernel versions on HiSilicon SoC devices and compare against the fixed stable trees referenced in the upstream commits.
Monitor /proc/meminfo, /proc/slabinfo, and dma_debug output for anomalous growth on hip04-equipped hosts.
Collect kernel logs centrally and alert on repeated allocation-failure messages from the hip04_eth driver.

Monitoring Recommendations

Track NIC counters via ethtool -S for RX drops and allocation-failure counters on hip04 interfaces.
Baseline long-term memory utilization on embedded hip04 devices and alert on sustained upward drift.
Forward kernel and network telemetry to a centralized analytics platform for correlation across fleets.

How to Mitigate CVE-2026-68135

Immediate Actions Required

Identify all systems running the Linux kernel with the hip04 Ethernet driver enabled.
Schedule updates to a kernel build that includes the upstream fix commits listed in the references.
Where patching is delayed, reduce exposure by limiting untrusted traffic reaching hip04 interfaces.

Patch Information

The fix is present in the upstream Linux stable tree via commits 14fa65d, 67a7614, 80d977f, a0f247d, and e054dcd. Rebuild affected kernels from a stable branch containing these commits and redeploy to affected devices.

Workarounds

Reboot affected hip04 devices on a scheduled basis to reclaim leaked memory until patching is complete.
Apply traffic shaping or rate limiting upstream of hip04 interfaces to reduce the probability of allocation failures under load.
Monitor memory pressure and preemptively fail over workloads from devices approaching exhaustion.

bash

# Verify running kernel and hip04 driver presence
uname -r
lsmod | grep -i hip04
dmesg | grep -Ei 'hip04|build_skb|dma_map_single'