Skip to content
OpenAdvisories
Unscored CVE-2022-50679 EUVD-2022-55726GHSA-75w2-9m25-jvqg

i40e: Fix DMA mappings leak

Published Dec 9, 2025 · Updated May 11, 2026 · Assigned by Linux

Vendor: Linux Product: Linux Package: linux Package: linux Package: linux-allwinner-5.19 Package: linux-aws Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.13 Package: linux-aws-5.15 Package: linux-aws-5.19 Package: linux-aws-5.3 Package: linux-aws-5.8 Package: linux-aws-6.2 Package: linux-aws-6.5 Package: linux-azure Package: linux-azure-5.11 Package: linux-azure-5.13 Package: linux-azure-5.15 Package: linux-azure-5.19 Package: linux-azure-5.3 Package: linux-azure-5.8 Package: linux-azure-6.11 Package: linux-azure-6.2 Package: linux-azure-6.5 Package: linux-azure-edge Package: linux-azure-fde Package: linux-azure-fde-5.19 Package: linux-azure-fde-6.2 Package: linux-bluefield Package: linux-gcp Package: linux-gcp-5.11 Package: linux-gcp-5.13 Package: linux-gcp-5.15 Package: linux-gcp-5.19 Package: linux-gcp-5.3 Package: linux-gcp-5.8 Package: linux-gcp-6.11 Package: linux-gcp-6.2 Package: linux-gcp-6.5 Package: linux-gke Package: linux-gke-4.15 Package: linux-gke-5.15 Package: linux-gke-5.4 Package: linux-gkeop Package: linux-gkeop-5.15 Package: linux-gkeop-5.4 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.13 Package: linux-hwe-5.15 Package: linux-hwe-5.19 Package: linux-hwe-5.8 Package: linux-hwe-6.11 Package: linux-hwe-6.2 Package: linux-hwe-6.5 Package: linux-hwe-edge Package: linux-ibm Package: linux-intel-5.13 Package: linux-intel-iot-realtime Package: linux-intel-iotg Package: linux-intel-iotg-5.15 Package: linux-kvm Package: linux-lowlatency Package: linux-lowlatency-hwe-5.15 Package: linux-lowlatency-hwe-5.19 Package: linux-lowlatency-hwe-6.11 Package: linux-lowlatency-hwe-6.2 Package: linux-lowlatency-hwe-6.5 Package: linux-nvidia Package: linux-nvidia-6.11 Package: linux-nvidia-6.2 Package: linux-nvidia-6.5 Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.14 Package: linux-oem-5.17 Package: linux-oem-5.6 Package: linux-oem-6.0 Package: linux-oem-6.1 Package: linux-oem-6.11 Package: linux-oem-6.5 Package: linux-oem-6.8 Package: linux-oracle Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.13 Package: linux-oracle-5.15 Package: linux-oracle-5.3 Package: linux-oracle-5.8 Package: linux-oracle-6.5 Package: linux-raspi Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.15 Package: linux-riscv-5.19 Package: linux-riscv-5.8 Package: linux-riscv-6.14 Package: linux-riscv-6.5 Package: linux-starfive-5.19 Package: linux-starfive-6.2 Package: linux-starfive-6.5 Package: linux-vmware Platform: Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

In the Linux kernel, the following vulnerability has been resolved:

i40e: Fix DMA mappings leak

During reallocation of RX buffers, new DMA mappings are created for
those buffers.

steps for reproduction:
while :
do
for ((i=0; i<=8160; i=i+32))
do
ethtool -G enp130s0f0 rx $i tx $i
sleep 0.5
ethtool -g enp130s0f0
done
done

This resulted in crash:
i40e 0000:01:00.1: Unable to allocate memory for the Rx descriptor ring, size=65536
Driver BUG
WARNING: CPU: 0 PID: 4300 at net/core/xdp.c:141 xdp_rxq_info_unreg+0x43/0x50
Call Trace:
i40e_free_rx_resources+0x70/0x80 [i40e]
i40e_set_ringparam+0x27c/0x800 [i40e]
ethnl_set_rings+0x1b2/0x290
genl_family_rcv_msg_doit.isra.15+0x10f/0x150
genl_family_rcv_msg+0xb3/0x160
? rings_fill_reply+0x1a0/0x1a0
genl_rcv_msg+0x47/0x90
? genl_family_rcv_msg+0x160/0x160
netlink_rcv_skb+0x4c/0x120
genl_rcv+0x24/0x40
netlink_unicast+0x196/0x230
netlink_sendmsg+0x204/0x3d0
sock_sendmsg+0x4c/0x50
__sys_sendto+0xee/0x160
? handle_mm_fault+0xbe/0x1e0
? syscall_trace_enter+0x1d3/0x2c0
__x64_sys_sendto+0x24/0x30
do_syscall_64+0x5b/0x1a0
entry_SYSCALL_64_after_hwframe+0x65/0xca
RIP: 0033:0x7f5eac8b035b
Missing register, driver bug
WARNING: CPU: 0 PID: 4300 at net/core/xdp.c:119 xdp_rxq_info_unreg_mem_model+0x69/0x140
Call Trace:
xdp_rxq_info_unreg+0x1e/0x50
i40e_free_rx_resources+0x70/0x80 [i40e]
i40e_set_ringparam+0x27c/0x800 [i40e]
ethnl_set_rings+0x1b2/0x290
genl_family_rcv_msg_doit.isra.15+0x10f/0x150
genl_family_rcv_msg+0xb3/0x160
? rings_fill_reply+0x1a0/0x1a0
genl_rcv_msg+0x47/0x90
? genl_family_rcv_msg+0x160/0x160
netlink_rcv_skb+0x4c/0x120
genl_rcv+0x24/0x40
netlink_unicast+0x196/0x230
netlink_sendmsg+0x204/0x3d0
sock_sendmsg+0x4c/0x50
__sys_sendto+0xee/0x160
? handle_mm_fault+0xbe/0x1e0
? syscall_trace_enter+0x1d3/0x2c0
__x64_sys_sendto+0x24/0x30
do_syscall_64+0x5b/0x1a0
entry_SYSCALL_64_after_hwframe+0x65/0xca
RIP: 0033:0x7f5eac8b035b

This was caused because of new buffers with different RX ring count should
substitute older ones, but those buffers were freed in
i40e_configure_rx_ring and reallocated again with i40e_alloc_rx_bi,
thus kfree on rx_bi caused leak of already mapped DMA.

Fix this by reallocating ZC with rx_bi_zc struct when BPF program loads. Additionally
reallocate back to rx_bi when BPF program unloads.

If BPF program is loaded/unloaded and XSK pools are created, reallocate
RX queues accordingly in XSP_SETUP_XSK_POOL handler.

Affected products

VendorProductAffectedFixed
Linux Linux 5.8 5.10.152

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 linux 6.0.6-1 —
Debian 13 linux 6.0.6-1 —
Debian 12 linux 6.0.6-1 —
ReleasePackageFixed inAdvisory
Ubuntu Nvidia-BlueField 22.04 LTS linux-bluefield 5.15.0-1014.16 —
Ubuntu 24.04 LTS linux-riscv +10 No fix yet —
Ubuntu 22.04 LTS linux +1 5.15.0-60.66 —
Ubuntu 22.04 LTS linux-aws 5.15.0-1030.34 —
Ubuntu 22.04 LTS linux-azure 5.15.0-1033.40 —
Ubuntu 22.04 LTS linux-azure-fde 5.15.0-1033.40.1 —
Ubuntu 22.04 LTS linux-gcp 5.15.0-1029.36 —
Ubuntu 22.04 LTS linux-gke 5.15.0-1027.32 —
Ubuntu 22.04 LTS linux-gkeop 5.15.0-1015.19 —
Ubuntu 22.04 LTS linux-ibm 5.15.0-1025.28 —
Ubuntu 22.04 LTS linux-intel-iotg 5.15.0-1025.30 —
Ubuntu 22.04 LTS linux-kvm 5.15.0-1028.33 —
Ubuntu 22.04 LTS linux-nvidia 5.15.0-1017.17 —
Ubuntu 22.04 LTS linux-oracle 5.15.0-1029.35 —
Ubuntu 22.04 LTS linux-raspi 5.15.0-1024.26 —
Ubuntu 22.04 LTS linux-riscv +32 No fix yet —
Ubuntu 20.04 LTS linux-aws-5.15 5.15.0-1030.34~20.04.1 —
Ubuntu 20.04 LTS linux-azure-5.15 5.15.0-1033.40~20.04.1 —
Ubuntu 20.04 LTS linux-gcp-5.15 5.15.0-1029.36~20.04.1 —
Ubuntu 20.04 LTS linux-gke +28 No fix yet —
Ubuntu 20.04 LTS linux-hwe-5.15 +1 5.15.0-60.66~20.04.1 —
Ubuntu 20.04 LTS linux-intel-iotg-5.15 5.15.0-1025.30~20.04.1 —
Ubuntu 20.04 LTS linux-oracle-5.15 5.15.0-1029.35~20.04.1 —
Ubuntu 20.04 LTS linux-riscv-5.15 5.15.0-1029.33~20.04.1 —
Ubuntu 18.04 LTS linux-gcp +14 No fix yet —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS linux-hwe-edge No fix yet —
ReleasePackageFixed inAdvisory
RHEL 9 bpftool 7.0.0-284.11.1.el9_2 RHSA-2023:2458
RHEL 9 perf +48 5.14.0-284.11.1.el9_2 RHSA-2023:2458
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 8.4 TUS perf +17 4.18.0-305.114.1.el8_4 RHSA-2023:7557
RHEL 8.4 E4S perf +25 4.18.0-305.114.1.el8_4 RHSA-2023:7557
RHEL 8.4 AUS perf +17 4.18.0-305.114.1.el8_4 RHSA-2023:7557
ReleasePackageFixed inAdvisory
SLES 15 SP5 kernel-64kb +6 5.14.21-150500.55.133.1 SUSE-SU-2026:0317-1
SLES 15 SP5 kernel-default-base 5.14.21-150500.55.133.1.150500.6.65.1 SUSE-SU-2026:0317-1
SLES 15 SP4 kernel-64kb +6 5.14.21-150400.24.194.1 SUSE-SU-2026:0617-1
SLES 15 SP4 kernel-default-base 5.14.21-150400.24.194.1.150400.24.98.3 SUSE-SU-2026:0617-1
Show 9 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP5 kernel-default-base 5.14.21-150500.55.133.1.150500.6.65.1 SUSE-SU-2026:0317-1
SLES for SAP 15 SP5 kernel-docs +4 5.14.21-150500.55.133.1 SUSE-SU-2026:0317-1
SLES for SAP 15 SP4 kernel-default-base 5.14.21-150400.24.194.1.150400.24.98.3 SUSE-SU-2026:0617-1
SLES for SAP 15 SP4 kernel-docs +4 5.14.21-150400.24.194.1 SUSE-SU-2026:0617-1
SLE Micro 5.5 kernel-default-base 5.14.21-150500.55.133.1.150500.6.65.1 SUSE-SU-2026:0317-1
SLE Micro 5.5 kernel-rt +1 5.14.21-150500.13.118.1 SUSE-SU-2026:0263-1
SLE Micro 5.5 kernel-source +1 5.14.21-150500.55.133.1 SUSE-SU-2026:0317-1
SLE Micro 5.4 kernel-default 5.14.21-150400.24.194.1 SUSE-SU-2026:0617-1
SLE Micro 5.4 kernel-default-base 5.14.21-150400.24.194.1.150400.24.98.3 SUSE-SU-2026:0617-1
SLE Micro 5.4 kernel-rt +1 5.14.21-150400.15.142.1 SUSE-SU-2026:0411-1
SLE Micro 5.3 kernel-default 5.14.21-150400.24.194.1 SUSE-SU-2026:0617-1
SLE Micro 5.3 kernel-default-base 5.14.21-150400.24.194.1.150400.24.98.3 SUSE-SU-2026:0617-1
SLE Micro 5.3 kernel-rt +1 5.14.21-150400.15.142.1 SUSE-SU-2026:0411-1
SLE Live Patching 15 SP5 kernel-default 5.14.21-150500.55.133.1 SUSE-SU-2026:0317-1
SLE Live Patching 15 SP5 kernel-livepatch-SLE15-SP5_Update_34 1-150500.11.3.1 SUSE-SU-2026:0317-1
SLE Live Patching 15 SP4 kernel-default 5.14.21-150400.24.194.1 SUSE-SU-2026:0617-1
SLE Live Patching 15 SP4 kernel-livepatch-SLE15-SP4_Update_48 1-150400.9.7.1 SUSE-SU-2026:0617-1
SLE HPC 15 SP5 kernel-64kb +5 5.14.21-150500.55.133.1 SUSE-SU-2026:0317-1
SLE HPC 15 SP5 kernel-default-base 5.14.21-150500.55.133.1.150500.6.65.1 SUSE-SU-2026:0317-1
SLE HPC 15 SP4 kernel-64kb +5 5.14.21-150400.24.194.1 SUSE-SU-2026:0617-1
SLE HPC 15 SP4 kernel-default-base 5.14.21-150400.24.194.1.150400.24.98.3 SUSE-SU-2026:0617-1

Advisories 7

References