PT-2026-61174 · Linux · Linux

CVE-2026-63857 · Published 2026-07-19 · Updated 2026-07-19

Mitre

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

net: airoha: Do not read uninitialized fragment address in airoha dev xmit()

The transmit loop in airoha dev xmit() reads fragment address and length during its final iteration, when the loop index equals skb shinfo(skb)->nr frags, at which point the fragment data is uninitialized. While these values are never consumed, the read itself is unsafe and may trigger a page fault. Fix this by avoiding the fragment read on the last iteration. Additionally, move the skb pointer from the first to the last used packet descriptor, so that airoha qdma tx napi poll() defers freeing the skb until the final descriptor is processed.

Fix

Related Identifiers

CVE-2026-63857

Affected Products

Linux

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-63857 · Security Note
• https://git.kernel.org/stable/c/bde34e84edc8b5571fbde7e941e175a4293ee1eb · Note
• https://git.kernel.org/stable/c/f670fa4b19ceddc6d215dda4997888ccba9bbc61 · Note
• https://git.kernel.org/stable/c/d78c8ab7bd84952e053d0c622b7fc1b4ad8a19a3 · Note