Skip to content
Heist/ feed
Critical

net: stmmac: fix integer underflow in chain mode

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix integer underflow in chain mode The jumbo_frm() chain-mode implementation unconditionally computes len = nopaged_len - bmax; where nopaged_len = skb_headlen(skb) (linear bytes only) and bmax is BUF_SIZE_8KiB or BUF_SIZE_2KiB. However, the caller stmmac_xmit() decides to invoke jumbo_frm() based on skb->len (total length including page fragments): is_jumbo = stmmac_is_jumbo_frm(priv, skb->len, enh_desc); When a packet has a small linear portion (nopaged_len <= bmax) but a large total length due to page fragments (skb->len > bmax), the subtraction wraps as an unsigned integer, producing a huge len value (~0xFFFFxxxx). This causes the while (len != 0) loop to execute hundreds of thousands of iterations, passing skb->data + bmax * i pointers far beyond the skb buffer to dma_map_single(). On IOMMU-less SoCs (the typical deployment for stmmac), this maps arbitrary kernel memory to the DMA engine, constituting a kernel memory disclosure and potential memory corruption from hardware. Fix this by introducing a buf_len local variable clamped to min(nopaged_len, bmax). Computing len = nopaged_len - buf_len is then always safe: it is zero when the linear portion fits within a single descriptor, causing the while (len != 0) loop to be skipped naturally, and the fragment loop in stmmac_xmit() handles page fragments afterward.

Announced Source revision 1
Original source ↗

CVE-2026-31649

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-31649

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "286a837217204b1ef105e3a554d0757e4fdfaac1",
        "lessThan": "513e06735f5be575b409d195822195348b164e48",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "286a837217204b1ef105e3a554d0757e4fdfaac1",
        "lessThan": "275bdf762e82082f064e60a92448fa2ac43cf95b",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "286a837217204b1ef105e3a554d0757e4fdfaac1",
        "lessThan": "a2b68a9a476b9544ff31f1fbcd5d80867a8a5e2f",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "286a837217204b1ef105e3a554d0757e4fdfaac1",
        "lessThan": "b7b8012193fd98236d7ae05d4b553f010a77b2ef",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "286a837217204b1ef105e3a554d0757e4fdfaac1",
        "lessThan": "2c91b39912278d0878f9ba60ba04d2518b18a08d",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "286a837217204b1ef105e3a554d0757e4fdfaac1",
        "lessThan": "6fca757c20396dc2e604dcc61922264e9e3dc803",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "286a837217204b1ef105e3a554d0757e4fdfaac1",
        "lessThan": "10d12b9240ebf96c785f0e2e4228318cd5f3a3eb",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "286a837217204b1ef105e3a554d0757e4fdfaac1",
        "lessThan": "51f4e090b9f87b40c21b6daadb5c06e6c0a07b67",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "drivers/net/ethernet/stmicro/stmmac/chain_mode.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "3.2"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "3.2",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.10.253",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.203",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.169",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.135",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.82",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.23",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "6.19.13",
        "versionType": "semver",
        "lessThanOrEqual": "6.19.*"
      },
      {
        "status": "unaffected",
        "version": "7.0",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "drivers/net/ethernet/stmicro/stmmac/chain_mode.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-31649

Source reference: /cveMetadata/cveId

Publisher severity

critical

Source reference: /containers/cna/metrics

Event
#39937 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement