{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97953", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:18:58.205Z", "datePublished": "2026-09-25T10:23:00.758Z", "dateUpdated": "2026-09-25T14:41:44.252Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-25T14:41:44.252Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: fix TX descriptor availability check for TSO traffic\n\nstmmac_tso_xmit() estimates the number of free TX descriptors required by\na TSO skb as:\n\n\t(skb->len - proto_hdr_len) / TSO_MAX_BUFF_SIZE + 1\n\nwhich assumes the payload is split into TSO_MAX_BUFF_SIZE chunks. This\nunderestimates the descriptors actually consumed by stmmac_tso_allocator(),\nsince each fragment is mapped individually and so it needs at least one\ndescriptor regardless of its size. Moreover, one descriptor is used for\nthe L2/L3/L4 headers and, when the MSS changes, one more is consumed for\nthe MSS context descriptor.\nFor a highly fragmented TSO skb the check can therefore pass even when the\nring has too few free slots. stmmac_tso_allocator() then writes past the\navailable descriptors, overwriting descriptors still owned by the DMA\nengine, corrupting the TX ring.\nAdd stmmac_tso_get_num_desc() to compute the exact number of descriptors\nneeded for the header, the linear payload and each fragment, plus the MSS\ncontext descriptor when required, and use it in the availability check."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H", "baseScore": 7, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - On a stmmac router or bridge, a remote sender's TCP segments are merged by GRO (payload left in the linear head plus up to 17 fragments) and forwarded to stmmac_tso_xmit(). Flows with different segment sizes also force an MSS context descriptor. The old check, (skb->len - proto_hdr_len)/TSO_MAX_BUFF_SIZE + 1, asks for 1 descriptor where 20 are written, so the remote packets themselves shape the skb that overruns the ring.\nAC:H - The overrun happens only when the queue is awake with stmmac_tx_avail() just under the real count (about 19 free for a 20-descriptor skb), and remotely it also needs the host to forward traffic and the ingress NIC to keep payload in the linear head. The attacker can flood toward that window and retry but cannot set ring occupancy exactly, and other traffic changes it.\nPR:N - No authentication is involved: GRO merging and IP forwarding/bridging to the stmmac egress port accept any sender's packets, and TSO is used for any forwarded GSO skb that passes stmmac_tso_valid_packet() (gso_size >= 64).\nUI:N - Nobody on the target has to do anything. The attacker's own flows produce the fragmented GSO skbs and fill the TX ring during normal forwarding.\nS:U - The damage stays inside the host kernel's stmmac TX ring and its bookkeeping (tx_skbuff[], tx_skbuff_dma[]). No VM, IOMMU or sandbox boundary is crossed.\nC:L - Once cur_tx catches up with dirty_tx, later sends overwrite descriptors the DMA engine still owns. Frames can then carry the wrong buffers or buffers already released by stmmac_tx_clean(), a limited, uncontrolled leak of data from other flows or memory. It gives no arbitrary read.\nI:L - Overwritten live descriptors garble other flows' outgoing frames (payload chunks swapped into the wrong TSO frame) and corrupt the driver's per-entry skb and DMA bookkeeping. The device only reads memory for TX, so there is no general kernel memory write.\nA:H - After the extra write makes the ring look empty (cur_tx == dirty_tx), completed skbs and DMA mappings are never reclaimed and later sends overwrite in-flight descriptors, triggering WARN_ONs, a TX stall, the netdev watchdog timeout and an interface reset. The attacker can repeat this at will."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"], "versions": [{"version": "f748be531d7012c456b97f66091d86b3675c5fef", "lessThan": "ffa6d2481bc1c87f822ecd626561484e4ee24cef", "status": "affected", "versionType": "git"}, {"version": "f748be531d7012c456b97f66091d86b3675c5fef", "lessThan": "c28175220f808c867d5618de8ecc6dbcc815c773", "status": "affected", "versionType": "git"}, {"version": "f748be531d7012c456b97f66091d86b3675c5fef", "lessThan": "65820fc743eae322f7f94f6a64d07861211d4b21", "status": "affected", "versionType": "git"}, {"version": "f748be531d7012c456b97f66091d86b3675c5fef", "lessThan": "5e38d732ec67a5b1f9a56e6c73add480c4b6030a", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"], "versions": [{"version": "4.7", "status": "affected"}, {"version": "0", "lessThan": "4.7", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "7.3-rc3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ffa6d2481bc1c87f822ecd626561484e4ee24cef"}, {"url": "https://git.kernel.org/stable/c/c28175220f808c867d5618de8ecc6dbcc815c773"}, {"url": "https://git.kernel.org/stable/c/65820fc743eae322f7f94f6a64d07861211d4b21"}, {"url": "https://git.kernel.org/stable/c/5e38d732ec67a5b1f9a56e6c73add480c4b6030a"}], "title": "net: stmmac: fix TX descriptor availability check for TSO traffic", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ffa6d2481bc1c87f822ecd626561484e4ee24cef", "status": "affected", "version": "f748be531d7012c456b97f66091d86b3675c5fef", "versionType": "git"}, {"lessThan": "c28175220f808c867d5618de8ecc6dbcc815c773", "status": "affected", "version": "f748be531d7012c456b97f66091d86b3675c5fef", "versionType": "git"}, {"lessThan": "65820fc743eae322f7f94f6a64d07861211d4b21", "status": "affected", "version": "f748be531d7012c456b97f66091d86b3675c5fef", "versionType": "git"}, {"lessThan": "5e38d732ec67a5b1f9a56e6c73add480c4b6030a", "status": "affected", "version": "f748be531d7012c456b97f66091d86b3675c5fef", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.7"}, {"lessThan": "4.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: fix TX descriptor availability check for TSO traffic\n\nstmmac_tso_xmit() estimates the number of free TX descriptors required by\na TSO skb as:\n\n\t(skb->len - proto_hdr_len) / TSO_MAX_BUFF_SIZE + 1\n\nwhich assumes the payload is split into TSO_MAX_BUFF_SIZE chunks. This\nunderestimates the descriptors actually consumed by stmmac_tso_allocator(),\nsince each fragment is mapped individually and so it needs at least one\ndescriptor regardless of its size. Moreover, one descriptor is used for\nthe L2/L3/L4 headers and, when the MSS changes, one more is consumed for\nthe MSS context descriptor.\nFor a highly fragmented TSO skb the check can therefore pass even when the\nring has too few free slots. stmmac_tso_allocator() then writes past the\navailable descriptors, overwriting descriptors still owned by the DMA\nengine, corrupting the TX ring.\nAdd stmmac_tso_get_num_desc() to compute the exact number of descriptors\nneeded for the header, the linear payload and each fragment, plus the MSS\ncontext descriptor when required, and use it in the availability check."}], "id": "CVE-2026-97953", "lastModified": "2026-09-25T15:18:02.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 4.7, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-25T11:17:22.930", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5e38d732ec67a5b1f9a56e6c73add480c4b6030a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/65820fc743eae322f7f94f6a64d07861211d4b21"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c28175220f808c867d5618de8ecc6dbcc815c773"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ffa6d2481bc1c87f822ecd626561484e4ee24cef"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}

{"created": "2026-09-25T15:00:20.849801+00:00", "title": "Potential TX Ring Corruption in Linux stmmac From Inadequate Descriptor Check for TSO Traffic", "updated": "2026-09-25T15:00:20.849806+00:00", "vendors": [], "weaknesses": ["CWE-119"]}