CVE-2026-98486: Linux Kernel MMIO Read Buffer Leak Vulnerability

CVE-2026-98486 Overview

CVE-2026-98486 is a memory leak vulnerability in the Linux kernel's Elastic Network Adapter (ENA) driver. The flaw resides in the ena_probe() error path, where a coherent Direct Memory Access (DMA) buffer allocated for Memory-Mapped I/O (MMIO) read responses is not released when probe initialization fails after ena_device_init() succeeds. Each failed probe attempt leaks a coherent DMA buffer, consuming limited kernel memory resources. The issue was identified through manual code inspection and has been resolved upstream across multiple stable kernel branches.

Critical Impact
Repeated probe failures of the ENA driver can exhaust coherent DMA memory, potentially degrading system stability on affected Linux hosts, including AWS EC2 instances that rely on the ENA driver for networking.

Affected Products

Linux kernel versions containing the ENA driver prior to the referenced stable commits
Linux distributions shipping affected kernel versions with the ena network driver module
AWS EC2 instances using the Elastic Network Adapter driver

Discovery Timeline

2026-10-18 - CVE-2026-98486 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98486

Vulnerability Analysis

The Linux kernel ENA network driver initializes its MMIO read mechanism during device probing by calling ena_com_mmio_reg_read_request_init(). This function allocates a coherent DMA buffer used to receive MMIO register read responses from the device. Under normal device removal, the buffer is released through ena_com_mmio_reg_read_request_destroy().

The defect occurs when ena_probe() fails after ena_device_init() has already succeeded. The existing error path tears down admin resources and eventually frees the ena_dev structure, but it never calls ena_com_mmio_reg_read_request_destroy(). The coherent DMA buffer remains allocated after the device structure is freed, resulting in a memory leak classified as [CWE-401].

Root Cause

The root cause is an incomplete cleanup sequence in the probe failure path. Resource acquisition in ena_device_init() is not mirrored by matching release calls in the error unwind, violating the acquire-release symmetry expected for coherent DMA allocations. Coherent DMA memory is a bounded resource, and leaks accumulate with each failed probe attempt.

Attack Vector

The vulnerability requires conditions that cause ena_probe() to fail after initial device setup. Triggers include transient hardware errors, resource contention during initialization, or repeated driver bind/unbind cycles against an ENA device. An attacker with the ability to induce probe failures on a system using the ENA driver could gradually exhaust coherent DMA memory. The flaw is a reliability and resource-exhaustion issue rather than a direct code execution vector.

The upstream fix adds the missing ena_com_mmio_reg_read_request_destroy() call in the probe error path before releasing remaining device resources. See the kernel commits referenced below for the exact patch content.

Detection Methods for CVE-2026-98486

Indicators of Compromise

Repeated ena_probe failure messages in dmesg or /var/log/kern.log on Linux hosts using the ENA driver.
Gradual reduction in available coherent DMA memory reported through /proc/meminfo or vendor-specific DMA accounting.
Driver bind/unbind events against ena devices appearing in audit logs without corresponding clean removal messages.

Detection Strategies

Inventory running kernel versions across the Linux fleet and compare against the fixed stable commits listed in the kernel.org references.
Monitor kernel ring buffer messages for the string ena_probe paired with error returns.
Correlate ENA driver load failures with host memory pressure trends to identify leaking systems.

Monitoring Recommendations

Centralize kernel logs from AWS EC2 instances using the ENA driver and alert on probe failure patterns.
Track coherent DMA allocation metrics on hosts under heavy driver reload workloads.
Include kernel package versions in configuration management inventories to accelerate exposure assessment.

How to Mitigate CVE-2026-98486

Immediate Actions Required

Identify Linux hosts running the ENA driver, including AWS EC2 instances, and inventory their kernel versions.
Schedule kernel updates to a version containing the upstream fix from the stable kernel commits referenced below.
Avoid unnecessary bind/unbind cycles of the ena driver on unpatched systems to limit leak accumulation.

Patch Information

The fix adds ena_com_mmio_reg_read_request_destroy() to the ena_probe() error path. It has been merged across multiple stable branches. See the following upstream commits for applicability to specific kernel versions:

Apply the distribution kernel update that incorporates these commits and reboot affected hosts.

Workarounds

Reboot hosts that have accumulated leaked coherent DMA buffers to reclaim memory until a patched kernel is deployed.
Restrict administrative operations that trigger repeated ENA driver probe attempts on unpatched hosts.
Monitor host memory telemetry and proactively migrate workloads from hosts showing abnormal DMA memory consumption.