Title: Linux, Description: En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:

net: ti: icssg-prueth: Corrección de fuga de memoria en XDP_DROP para el modo sin copia cero

El reciclaje de páginas fue eliminado de la ruta XDP_DROP en emac_run_xdp() para evitar conflictos con el modo de copia cero de AF_XDP, que usa xsk_buff_free() en su lugar.

Sin embargo, esto causa una fuga de memoria al ejecutar programas XDP que descartan paquetes en modo sin copia cero (modo de pool de páginas estándar). Las páginas nunca son devueltas al pool de páginas, lo que lleva a condiciones de OOM.

Esto se soluciona manejando la limpieza en la función llamadora, emac_rx_packet(). Cuando emac_run_xdp() devuelve ICSSG_XDP_CONSUMED para XDP_DROP, la función llamadora ahora recicla la página de vuelta al pool de páginas. La ruta de copia cero, emac_rx_packet_zc(), ya maneja la limpieza correctamente con xsk_buff_free().

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/ti/icssg/icssg_common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7a64bb388df3cf091afdd047c701039a13acd3b4","lessThan":"d16d57dedcb69c1a1257e0638f8698ce1f0ccbe5","versionType":"git","status":"affected"},{"version":"7a64bb388df3cf091afdd047c701039a13acd3b4","lessThan":"719d3e71691db7c4f1658ba5a6d1472928121594","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/ti/icssg/icssg_common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","versionType":"semver","status":"unaffected"},{"version":"6.19.10","lessThanOrEqual":"6.19.*","versionType":"semver","status":"unaffected"},{"version":"7.0","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]

CWE-401

OR
          *cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 6.19.10

kernel.org: https://git.kernel.org/stable/c/719d3e71691db7c4f1658ba5a6d1472928121594 Types: Patch

kernel.org: https://git.kernel.org/stable/c/d16d57dedcb69c1a1257e0638f8698ce1f0ccbe5 Types: Patch

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

In the Linux kernel, the following vulnerability has been resolved:

net: ti: icssg-prueth: Fix memory leak in XDP_DROP for non-zero-copy mode

Page recycling was removed from the XDP_DROP path in emac_run_xdp() to
avoid conflicts with AF_XDP zero-copy mode, which uses xsk_buff_free()
instead.

However, this causes a memory leak when running XDP programs that drop
packets in non-zero-copy mode (standard page pool mode). The pages are
never returned to the page pool, leading to OOM conditions.

Fix this by handling cleanup in the caller, emac_rx_packet().
When emac_run_xdp() returns ICSSG_XDP_CONSUMED for XDP_DROP, the
caller now recycles the page back to the page pool. The zero-copy
path, emac_rx_packet_zc() already handles cleanup correctly with
xsk_buff_free().

https://git.kernel.org/stable/c/719d3e71691db7c4f1658ba5a6d1472928121594

https://git.kernel.org/stable/c/d16d57dedcb69c1a1257e0638f8698ce1f0ccbe5