CVE-2026-97614: net: dsa: tag_brcm: legacy FCS: request needed tailroom
In the Linux kernel, the following vulnerability has been resolved:
net: dsa: tagbrcm: legacy FCS: request needed tailroom
The legacy FCS tagger calculates the CRC over skb->len bytes starting at skb->data. When a nonlinear skb reaches the tagger, this reads past the linear head into unrelated slab memory.
The tagger appends an Ethernet FCS but does not declare that tailroom. As a result, DSA leaves NETIFFSG and NETIFFFRAGLIST enabled on the user port, and nonlinear skbs can reach the CRC calculation.
Declare the required tailroom. DSA will then clear those features and the networking core will linearize skbs before the tagger runs.
A KASAN-enabled dsaloop test using this tagger reports:
BUG: KASAN: slab-out-of-bounds in crc32le Read of size 1 at addr ffff8880397086c0 by task exp/135
Call Trace: crc32le (lib/crc/crc32-main.c:38) brcmlegfcstagxmit (net/dsa/tagbrcm.c:343) dsauserxmit (net/dsa/user.c:942) devhardstartxmit (net/core/dev.c:3937) devqueuexmit (net/core/dev.c:4926) packetsendmsg (net/packet/afpacket.c:3110) syssendto (net/socket.c:2281)
The buggy address belongs to the object at ffff888039708400 which belongs to the cache skbuffsmallhead of size 704 The buggy address is located 0 bytes to the right of allocated 704-byte region [ffff888039708400, ffff8880397086c0)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
For the legacy FCS tagger, declare the required tailroom so the networking core linearizes skbs before the tagger runs.
Event History
Frequently Asked Questions
Which systems are affected?
Affected systems use the Linux DSA subsystem with the Broadcom legacy FCS tagger on a DSA user port. The out-of-bounds read requires a nonlinear skb to reach that tagger during transmission.
What condition triggers the memory read?
The legacy FCS tagger calculates a CRC across skb->len bytes from skb->data, but nonlinear skbs do not necessarily contain all data in the linear head. This can make the CRC calculation read beyond the skb linear area into unrelated slab memory.
How can this issue be detected?
A KASAN-enabled system can report a slab-out-of-bounds read in crc32_le, with brcm_leg_fcs_tag_xmit and dsa_user_xmit in the call trace. The reported test path used dsa_loop and transmitted through the affected tagger.