CVE-2026-72056: net: ena: clean up XDP TX queues when regular TX setup fails

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net: ena: clean up XDP TX queues when regular TX setup fails

create_queues_with_size_backoff() creates XDP TX queues before setting
up the regular TX path. If the subsequent allocation or creation of
regular TX queues fails, the error handling paths omit the teardown of the
XDP TX queues, leading to a resource leak.

Fix this by explicitly destroying the XDP TX queue subset at the two
missing failure points.

The bug was first flagged by an experimental analysis tool we are
developing for kernel memory-management bugs while analyzing
v6.13-rc1. The tool is still under development and is not yet publicly
available. Manual inspection confirms that the bug is still
present in v7.1-rc7.

An x86_64 allyesconfig build showed no new warnings. As we do not have
an ENA device to test with, no runtime testing was able to be performed.

The Linux kernel CVE team has assigned CVE-2026-72056 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.6 with commit 548c4940b9f1f527f81509468dd60b61418880b6 and fixed in 5.10.261 with commit df65d9fea8437235e740552e542fb309765507db
	Issue introduced in 5.6 with commit 548c4940b9f1f527f81509468dd60b61418880b6 and fixed in 5.15.212 with commit 5daa63404b708fc74e94da8398affbb148d09044
	Issue introduced in 5.6 with commit 548c4940b9f1f527f81509468dd60b61418880b6 and fixed in 6.1.178 with commit 523caef03124ecc08ce62a78c617759c2d28cf1c
	Issue introduced in 5.6 with commit 548c4940b9f1f527f81509468dd60b61418880b6 and fixed in 6.6.145 with commit f2ff634d95f8a6c885b9ce71a64067e255bcc34a
	Issue introduced in 5.6 with commit 548c4940b9f1f527f81509468dd60b61418880b6 and fixed in 6.12.97 with commit 6773d6d82bdabddab2b31605d6d7029c91dbd217
	Issue introduced in 5.6 with commit 548c4940b9f1f527f81509468dd60b61418880b6 and fixed in 6.18.40 with commit 6596baf8041100a9d1647beb5ea8ea4496ce058f
	Issue introduced in 5.6 with commit 548c4940b9f1f527f81509468dd60b61418880b6 and fixed in 7.1.5 with commit 11f68ebc6891d11de5f32b7dee918c5dc18b8de1
	Issue introduced in 5.6 with commit 548c4940b9f1f527f81509468dd60b61418880b6 and fixed in 7.2-rc1 with commit 1bd6676254b4ab6acd44b662b5e92822c036463a

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-72056
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/ethernet/amazon/ena/ena_netdev.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/df65d9fea8437235e740552e542fb309765507db
	https://git.kernel.org/stable/c/5daa63404b708fc74e94da8398affbb148d09044
	https://git.kernel.org/stable/c/523caef03124ecc08ce62a78c617759c2d28cf1c
	https://git.kernel.org/stable/c/f2ff634d95f8a6c885b9ce71a64067e255bcc34a
	https://git.kernel.org/stable/c/6773d6d82bdabddab2b31605d6d7029c91dbd217
	https://git.kernel.org/stable/c/6596baf8041100a9d1647beb5ea8ea4496ce058f
	https://git.kernel.org/stable/c/11f68ebc6891d11de5f32b7dee918c5dc18b8de1
	https://git.kernel.org/stable/c/1bd6676254b4ab6acd44b662b5e92822c036463a