CVE-2026-64055: net: ethernet: cortina: Carry over frag counter
In the Linux kernel, the following vulnerability has been resolved:
net: ethernet: cortina: Carry over frag counter
The gmacrx() NAPI poll function assembles packets in an SKB from a ring buffer.
If the ring buffer gets completely emptied during a poll cycle, we exit gmacrx(), but the packet is not yet completely assembled in the SKB, yet the fragment counter fragnr is reset to zero on the next invocation.
Solve this by making the RX fragment counter a part of the port struct, and carry it over between invocations.
Reset the fragment counter only right after calling napigrofrags(), on error (after calling napifreefrags()) or if stopping the port.
Reset it in some place where not strictly necessary just to emphasize what is going on.
This was found by Sashiko during normal patch review.
Affected Software
Remediation
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running the Linux kernel with the Cortina Ethernet driver are the relevant population. The issue occurs in the driver's receive-path packet assembly during NAPI polling.
Does exploitation require local access, credentials, or user interaction?
The supplied CVSS vector indicates network reachability, low attack complexity, no privileges required, and no user interaction. It also rates confidentiality, integrity, and availability impact as high.
What should be done if the affected driver is in use?
Apply an available patch. The referenced stable kernel commits provide the fix.
How can I determine whether a system needs remediation?
Determine whether the running Linux kernel uses the Cortina Ethernet driver. If it does, verify that the kernel includes one of the referenced stable fixes; no affected or fixed version numbers are provided in the available data.