PT-2026-61174 · Linux · Linux

CVE-2026-63857 · Publicado 2026-07-19 · Atualizado 2026-07-19

Mitre

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

net: airoha: Do not read uninitialized fragment address in airoha dev xmit()

The transmit loop in airoha dev xmit() reads fragment address and length during its final iteration, when the loop index equals skb shinfo(skb)->nr frags, at which point the fragment data is uninitialized. While these values are never consumed, the read itself is unsafe and may trigger a page fault. Fix this by avoiding the fragment read on the last iteration. Additionally, move the skb pointer from the first to the last used packet descriptor, so that airoha qdma tx napi poll() defers freeing the skb until the final descriptor is processed.

Correção

Identificadores relacionados

CVE-2026-63857

Produtos afetados

Linux

Referências · 4

• https://git.kernel.org/stable/c/bde34e84edc8b5571fbde7e941e175a4293ee1eb · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-63857 · Nota de Segurança
• https://git.kernel.org/stable/c/f670fa4b19ceddc6d215dda4997888ccba9bbc61 · Nota
• https://git.kernel.org/stable/c/d78c8ab7bd84952e053d0c622b7fc1b4ad8a19a3 · Nota