Cloudanix VulnDB

CVE-2026-98803

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A networking driver bug can cause certain Ethernet hardware to crash when handling large incoming data packets on systems that use memory protection features.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Unmapped secondary RX buffer (buffer2/sec_page) is handed to DMA for oversized frames when split-header is inactive on GMAC4/XGMAC cores; DMA writes trigger SMMU faults or memory corruption on IOMMU platforms.

Why it matters to the business

Network receive traffic can crash or destabilize systems using affected Ethernet controllers, especially on ARM IOMMU platforms, leading to unplanned downtime and service interruption.

How an attack unfolds

An attacker sends jumbo or oversized Ethernet frames that exceed dma_buf_sz; the driver fails to allocate and map buffer2 for non-SPH frames, so DMA writes into an unmapped address, producing translation faults or corrupting memory.

How to fix it

Apply the upstream fix that allocates and validates buffer2 for non-SPH frames on GMAC4/XGMAC, widens the page-pool sync window, and uses pskb_trim for FCS removal; rebuild and deploy the patched kernel; disable jumbo frames or SPH-incompatible configurations as a temporary mitigation where feasible.

How to confirm the fix worked

Verify the stmmac driver contains the updated stmmac_init_rx_buffers and stmmac_rx_refill logic that sets buffer2 for non-SPH paths; confirm no SMMU faults occur when receiving frames > dma_buf_sz; check that page-pool offset is 0 and max_len covers both buffers.

Typical attack path

  1. Attacker transmits frames larger than the configured DMA buffer size
  2. stmmac_rx_refill / stmmac_init_rx_buffers skips allocation of buffer2 when SPH is disabled
  3. DMA controller writes overflow data to the invalid secondary buffer address
  4. IOMMU detects the illegal access and raises a context fault (SMMU FSR 0x402)
  5. Kernel logs the fault and may reset the interface or panic

How to detect it

Search kernel logs and dmesg for arm-smmu unhandled context fault messages containing fsr=0x402, stmmac, or net RX buffer references; inspect crash dumps for DMA writes to unmapped RX buffer addresses; correlate with network interface resets or packet loss spikes.

  • arm-smmu.*Unhandled context fault: fsr=0x402
  • arm-smmu.*FSYN R0 = 007f0011
  • stmmac.*rx Scatter-Gather
  • SMMU translation fault.*buffer2

What your security team should do

  • Prioritize kernel update for all systems using stmmac on IOMMU-enabled platforms within the next patch cycle
  • Monitor kernel logs for arm-smmu context faults referencing stmmac or net RX paths
  • Temporarily limit MTU or disable jumbo support on affected interfaces until patched
  • Track EPSS and KEV status for any future exploitation increase

The record

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix rx Scatter-Gather support When a received frame is larger than dma_buf_sz, the DMA scatters it across multiple RX descriptors (rx Scatter-Gather). The secondary RX buffer (sec_page) was only allocated and programmed when split-header (SPH) was active, so for regular frames buffer2 was neither allocated nor backed by a valid mapping. As soon as an incoming frame overflowed buffer1, the DMA wrote the overflow into the unmapped secondary-buffer address, triggering an SMMU translation fault on IOMMU-based platforms: arm-smmu 15000000.iommu: Unhandled context fault: fsr=0x402, iova=0x00000000, fsynr=0x7f0011, cbfrsynra=0x1c90, cb=11 arm-smmu 15000000.iommu: FSR = 00000402 [Format=2 TF], SID=0x1c90 arm-smmu 15000000.iommu: FSYNR0 = 007f0011 [S1CBNDX=127 WNR PLVL=1] Enable scatter-gather for non-SPH frames on cores that can program an independent secondary RX buffer (GMAC4/XGMAC): allocate and mark buffer2 as valid in stmmac_init_rx_buffers() and stmmac_rx_refill(), and account for it in the buffer length computation. Legacy cores have no set_sec_addr op, so they keep buffer2 disabled. Since buffer2 is handed to the DMA at page offset 0, the page pool sync window is widened to cover both buffers in every mode: offset is set to 0 and max_len to dma_buf_sz + stmmac_rx_offset(). The FCS can straddle the buffer1/buffer2 boundary and a descriptor boundary, so it is now stripped from the tail of the assembled frame with pskb_trim() instead of from a single buffer, avoiding an unsigned underflow for frames that overflow a buffer by 1..3 bytes. For single-buffer frames the XDP program must not see the FCS, so it is removed from the XDP buffer before the program runs. Native XDP currently only supports single-buffer (linear) frames. An oversized frame accepted by the MAC (jumbo enabled) is received via buffer2; the XDP program only sees buffer1, so on a TX/REDIRECT verdict the frame is forwarded truncated. XDP multi-buffer support to handle this case is planned as a follow-up. AF_XDP zero-copy RX is not covered by this change: a ZC queue still programs buffer2 at DMA address 0 (and XGMAC has no buffer2-valid bit), so an oversized frame overflowing buffer1 can still trigger the same SMMU translation fault. Handling is planned as a follow-up.

Affected packages

Ecosystem Package Introduced Fixed