net: stmmac: fix integer underflow in chain mode
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix integer underflow in chain mode The jumbo_frm() chain-mode implementation unconditionally computes len = nopaged_len - bmax; where nopaged_len = skb_headlen(skb) (linear bytes only) and bmax is BUF_SIZE_8KiB or BUF_SIZE_2KiB. However, the caller stmmac_xmit() decides to invoke jumbo_frm() based on skb->len (total length including page fragments): is_jumbo = stmmac_is_jumbo_frm(priv, skb->len, enh_desc); When a packet has a small linear portion (nopaged_len <= bmax) but a large total length due to page fragments (skb->len > bmax), the subtraction wraps as an unsigned integer, producing a huge len value (~0xFFFFxxxx). This causes the while (len != 0) loop to execute hundreds of thousands of iterations, passing skb->data + bmax * i pointers far beyond the skb buffer to dma_map_single(). On IOMMU-less SoCs (the typical deployment for stmmac), this maps arbitrary kernel memory to the DMA engine, constituting a kernel memory disclosure and potential memory corruption from hardware. Fix this by introducing a buf_len local variable clamped to min(nopaged_len, bmax). Computing len = nopaged_len - buf_len is then always safe: it is zero when the linear portion fits within a single descriptor, causing the while (len != 0) loop to be skipped naturally, and the fragment loop in stmmac_xmit() handles page fragments afterward.
CVE-2026-31649
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-31649
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "286a837217204b1ef105e3a554d0757e4fdfaac1",
"lessThan": "513e06735f5be575b409d195822195348b164e48",
"versionType": "git"
},
{
"status": "affected",
"version": "286a837217204b1ef105e3a554d0757e4fdfaac1",
"lessThan": "275bdf762e82082f064e60a92448fa2ac43cf95b",
"versionType": "git"
},
{
"status": "affected",
"version": "286a837217204b1ef105e3a554d0757e4fdfaac1",
"lessThan": "a2b68a9a476b9544ff31f1fbcd5d80867a8a5e2f",
"versionType": "git"
},
{
"status": "affected",
"version": "286a837217204b1ef105e3a554d0757e4fdfaac1",
"lessThan": "b7b8012193fd98236d7ae05d4b553f010a77b2ef",
"versionType": "git"
},
{
"status": "affected",
"version": "286a837217204b1ef105e3a554d0757e4fdfaac1",
"lessThan": "2c91b39912278d0878f9ba60ba04d2518b18a08d",
"versionType": "git"
},
{
"status": "affected",
"version": "286a837217204b1ef105e3a554d0757e4fdfaac1",
"lessThan": "6fca757c20396dc2e604dcc61922264e9e3dc803",
"versionType": "git"
},
{
"status": "affected",
"version": "286a837217204b1ef105e3a554d0757e4fdfaac1",
"lessThan": "10d12b9240ebf96c785f0e2e4228318cd5f3a3eb",
"versionType": "git"
},
{
"status": "affected",
"version": "286a837217204b1ef105e3a554d0757e4fdfaac1",
"lessThan": "51f4e090b9f87b40c21b6daadb5c06e6c0a07b67",
"versionType": "git"
}
],
"programFiles": [
"drivers/net/ethernet/stmicro/stmmac/chain_mode.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "3.2"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "3.2",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.169",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.135",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.82",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.23",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "6.19.13",
"versionType": "semver",
"lessThanOrEqual": "6.19.*"
},
{
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/net/ethernet/stmicro/stmmac/chain_mode.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-31649
Source reference:
/cveMetadata/cveId
Publisher severity
critical
Source reference: /containers/cna/metrics
- Event
- #39937 · Revision 1
- Added to Heist Feed
- Publisher date