CVE-2026-98492: Linux Kernel Memory Leak Vulnerability

CVE-2026-98492 Overview

CVE-2026-98492 is a memory leak vulnerability in the Linux kernel's Cadence MACB/GEM Ethernet driver (drivers/net/ethernet/cadence/macb_main.c). The flaw affects the macb_alloc() function, which fails to properly track DMA-coherent buffers before invoking error-path cleanup. When buffer allocation fails or crosses a 4GB DMA boundary, the driver calls macb_free() to release resources, but the allocated buffers were never stored in bp->queues[0]. The result is that transmit and receive DMA buffers leak on specific error paths during driver initialization.

Critical Impact
Repeated driver load failures can exhaust DMA-coherent memory, degrading networking functionality on affected systems.

Affected Products

Linux kernel (upstream, mainline)
Systems using the Cadence macb Ethernet driver
Stable kernel branches referenced by the backport commits

Discovery Timeline

2026-10-18 - CVE-2026-98492 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-98492

Vulnerability Analysis

The vulnerability resides in the macb_alloc() initialization routine within the Cadence MACB/GEM network driver. The function allocates DMA-coherent buffers using dma_alloc_coherent() for transmit and receive rings. On error, the driver invokes macb_free(bp), which iterates over bp->queues[0] to release previously allocated resources.

Three distinct error paths leak memory:

Transmit buffer allocated but crossing a 4GB DMA boundary: Tx buffer leaks.
Receive buffer allocation fails: previously allocated Tx buffer leaks.
Receive buffer allocated but crossing a 4GB DMA boundary: both Tx and Rx buffers leak.

Because the newly allocated buffers were not yet assigned to bp->queues[0], the cleanup routine has no reference to free them. Each failed initialization permanently consumes DMA-coherent memory from the system pool.

Root Cause

The root cause is an ordering defect in resource tracking. The driver allocates DMA buffers but defers storing their pointers into the queue structure until after boundary validation. If validation fails, cleanup logic cannot locate the buffers to release them. This is a Memory Leak condition in kernel initialization code.

Attack Vector

This is a reliability and resource-exhaustion defect triggered during driver bring-up on hardware using the MACB/GEM Ethernet controller. The condition requires repeated driver load failures or hardware configurations that cause DMA allocations to cross 4GB boundaries. There is no indication of remote exploitation. Impact is limited to kernel memory pressure and potential denial of service on long-running embedded or server systems that cycle the network interface.

The fix stores allocated buffers into bp->queues[0] immediately after allocation so that macb_free() can release them on any subsequent failure.

Detection Methods for CVE-2026-98492

Indicators of Compromise

Repeated dma_alloc_coherent failures logged in kernel ring buffer during macb driver probe or interface restart.
Growing unaccounted DMA-coherent memory consumption visible in /proc/meminfo and /sys/kernel/debug/dma-api/.
Kernel messages from the macb driver reporting buffer boundary issues followed by probe failure.

Detection Strategies

Audit systems running Cadence MACB/GEM Ethernet hardware against patched stable kernel versions referenced in the upstream commits.
Monitor dmesg for macb driver initialization errors paired with memory allocation warnings.
Track long-term DMA-coherent memory usage trends on embedded platforms to identify gradual leaks.

Monitoring Recommendations

Enable CONFIG_DMA_API_DEBUG on test systems to surface leaked DMA mappings during driver cycling.
Correlate network interface flapping events with kernel memory statistics to detect leak accumulation.
Forward kernel logs to a centralized telemetry pipeline for anomaly detection on macb subsystem messages.

How to Mitigate CVE-2026-98492

Immediate Actions Required

Identify systems running the Linux macb Ethernet driver, particularly embedded platforms using Cadence or Microchip SoCs.
Apply the upstream fix or update to a stable kernel release containing the referenced patch commits.
Avoid repeated driver load/unload cycles on unpatched systems to minimize cumulative DMA memory loss.

Patch Information

The fix stores allocated DMA buffers into bp->queues[0] as soon as allocation succeeds, ensuring macb_free() can release them on any error path. Patches are available in the upstream kernel tree:

Workarounds

Reboot affected systems periodically to reclaim leaked DMA-coherent memory until patches are deployed.
Avoid scripts or orchestration logic that repeatedly reload the macb kernel module.
Where possible, pin the network interface configuration to reduce probe retries during boot.

bash

# Verify kernel version and macb module status
uname -r
modinfo macb | grep -E '^(version|filename|srcversion)'

# Review recent macb driver messages
dmesg | grep -i macb