CVE-2026-97953 (GCVE-0-2026-97953)
Vulnerability from cvelistv5
Published
2026-09-25 10:23
Modified
2026-10-21 12:53
Severity ?
7.0 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TX descriptor availability check for TSO traffic stmmac_tso_xmit() estimates the number of free TX descriptors required by a TSO skb as: (skb->len - proto_hdr_len) / TSO_MAX_BUFF_SIZE + 1 which assumes the payload is split into TSO_MAX_BUFF_SIZE chunks. This underestimates the descriptors actually consumed by stmmac_tso_allocator(), since each fragment is mapped individually and so it needs at least one descriptor regardless of its size. Moreover, one descriptor is used for the L2/L3/L4 headers and, when the MSS changes, one more is consumed for the MSS context descriptor. For a highly fragmented TSO skb the check can therefore pass even when the ring has too few free slots. stmmac_tso_allocator() then writes past the available descriptors, overwriting descriptors still owned by the DMA engine, corrupting the TX ring. Add stmmac_tso_get_num_desc() to compute the exact number of descriptors needed for the header, the linear payload and each fragment, plus the MSS context descriptor when required, and use it in the availability check.
References
Impacted products
Vendor Product Version
Linux Linux Version: f748be531d7012c456b97f66091d86b3675c5fef
Version: f748be531d7012c456b97f66091d86b3675c5fef
Version: f748be531d7012c456b97f66091d86b3675c5fef
Version: f748be531d7012c456b97f66091d86b3675c5fef
Version: f748be531d7012c456b97f66091d86b3675c5fef
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "09c30547da2c45bb79f7d3adffc860af332c2d42",
              "status": "affected",
              "version": "f748be531d7012c456b97f66091d86b3675c5fef",
              "versionType": "git"
            },
            {
              "lessThan": "ffa6d2481bc1c87f822ecd626561484e4ee24cef",
              "status": "affected",
              "version": "f748be531d7012c456b97f66091d86b3675c5fef",
              "versionType": "git"
            },
            {
              "lessThan": "c28175220f808c867d5618de8ecc6dbcc815c773",
              "status": "affected",
              "version": "f748be531d7012c456b97f66091d86b3675c5fef",
              "versionType": "git"
            },
            {
              "lessThan": "65820fc743eae322f7f94f6a64d07861211d4b21",
              "status": "affected",
              "version": "f748be531d7012c456b97f66091d86b3675c5fef",
              "versionType": "git"
            },
            {
              "lessThan": "5e38d732ec67a5b1f9a56e6c73add480c4b6030a",
              "status": "affected",
              "version": "f748be531d7012c456b97f66091d86b3675c5fef",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "lessThan": "4.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: fix TX descriptor availability check for TSO traffic\n\nstmmac_tso_xmit() estimates the number of free TX descriptors required by\na TSO skb as:\n\n\t(skb-\u003elen - proto_hdr_len) / TSO_MAX_BUFF_SIZE + 1\n\nwhich assumes the payload is split into TSO_MAX_BUFF_SIZE chunks. This\nunderestimates the descriptors actually consumed by stmmac_tso_allocator(),\nsince each fragment is mapped individually and so it needs at least one\ndescriptor regardless of its size. Moreover, one descriptor is used for\nthe L2/L3/L4 headers and, when the MSS changes, one more is consumed for\nthe MSS context descriptor.\nFor a highly fragmented TSO skb the check can therefore pass even when the\nring has too few free slots. stmmac_tso_allocator() then writes past the\navailable descriptors, overwriting descriptors still owned by the DMA\nengine, corrupting the TX ring.\nAdd stmmac_tso_get_num_desc() to compute the exact number of descriptors\nneeded for the header, the linear payload and each fragment, plus the MSS\ncontext descriptor when required, and use it in the availability check."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - On a stmmac router or bridge, a remote sender\u0027s TCP segments are merged by GRO (payload left in the linear head plus up to 17 fragments) and forwarded to stmmac_tso_xmit(). Flows with different segment sizes also force an MSS context descriptor. The old check, (skb-\u003elen - proto_hdr_len)/TSO_MAX_BUFF_SIZE + 1, asks for 1 descriptor where 20 are written, so the remote packets themselves shape the skb that overruns the ring.\nAC:H - The overrun happens only when the queue is awake with stmmac_tx_avail() just under the real count (about 19 free for a 20-descriptor skb), and remotely it also needs the host to forward traffic and the ingress NIC to keep payload in the linear head. The attacker can flood toward that window and retry but cannot set ring occupancy exactly, and other traffic changes it.\nPR:N - No authentication is involved: GRO merging and IP forwarding/bridging to the stmmac egress port accept any sender\u0027s packets, and TSO is used for any forwarded GSO skb that passes stmmac_tso_valid_packet() (gso_size \u003e= 64).\nUI:N - Nobody on the target has to do anything. The attacker\u0027s own flows produce the fragmented GSO skbs and fill the TX ring during normal forwarding.\nS:U - The damage stays inside the host kernel\u0027s stmmac TX ring and its bookkeeping (tx_skbuff[], tx_skbuff_dma[]). No VM, IOMMU or sandbox boundary is crossed.\nC:L - Once cur_tx catches up with dirty_tx, later sends overwrite descriptors the DMA engine still owns. Frames can then carry the wrong buffers or buffers already released by stmmac_tx_clean(), a limited, uncontrolled leak of data from other flows or memory. It gives no arbitrary read.\nI:L - Overwritten live descriptors garble other flows\u0027 outgoing frames (payload chunks swapped into the wrong TSO frame) and corrupt the driver\u0027s per-entry skb and DMA bookkeeping. The device only reads memory for TX, so there is no general kernel memory write.\nA:H - After the extra write makes the ring look empty (cur_tx == dirty_tx), completed skbs and DMA mappings are never reclaimed and later sends overwrite in-flight descriptors, triggering WARN_ONs, a TX stall, the netdev watchdog timeout and an interface reset. The attacker can repeat this at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:53:49.828Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/09c30547da2c45bb79f7d3adffc860af332c2d42"
        },
        {
          "url": "https://git.kernel.org/stable/c/ffa6d2481bc1c87f822ecd626561484e4ee24cef"
        },
        {
          "url": "https://git.kernel.org/stable/c/c28175220f808c867d5618de8ecc6dbcc815c773"
        },
        {
          "url": "https://git.kernel.org/stable/c/65820fc743eae322f7f94f6a64d07861211d4b21"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e38d732ec67a5b1f9a56e6c73add480c4b6030a"
        }
      ],
      "title": "net: stmmac: fix TX descriptor availability check for TSO traffic",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97953",
    "datePublished": "2026-09-25T10:23:00.758Z",
    "dateReserved": "2026-09-25T10:18:58.205Z",
    "dateUpdated": "2026-10-21T12:53:49.828Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.