CVE-2026-53215

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: mvpp2: refill RX buffers before XDP or skb use<br /> <br /> The RX error path returns the current descriptor buffer to the hardware<br /> BM pool. That is only valid while the driver still owns the buffer.<br /> <br /> mvpp2_rx_refill() can fail after the current buffer has been handed to<br /> XDP or attached to an skb. In those cases mvpp2_run_xdp() may have<br /> recycled, redirected, or queued the page for XDP_TX, and an skb free also<br /> retires the data buffer. Returning such a buffer to BM lets hardware DMA<br /> into memory that is no longer owned by the RX ring.<br /> <br /> Refill the BM pool before handing the current buffer to XDP or to the<br /> skb. If the allocation fails there, drop the packet and return the<br /> still-owned current buffer to BM, preserving the pool depth. Once the<br /> refill succeeds, later local drops retire/free the current buffer instead<br /> of returning it to BM.