CVE-2026-31646

net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool()

published April 24, 2026

CVSS
—
EPSS
0%
Percentile
5.0
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool()

page_pool_create() can return an ERR_PTR on failure. The return value

is used unconditionally in the loop that follows, passing the error

pointer through xdp_rxq_info_reg_mem_model() into page_pool_use_xdp_mem(),

which dereferences it, causing a kernel oops.

Add an IS_ERR check after page_pool_create() to return early on failure.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00162 · 5.0th percentile
Published
2026-04-24T14:44Z
EPSS history
Timeline
  • 24 APR 14:44Z
    net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool()
    cvelistv5