CVE-2026-97953: net: stmmac: fix TX descriptor availability check for TSO traffic
In the Linux kernel, the following vulnerability has been resolved:
net: stmmac: fix TX descriptor availability check for TSO traffic
stmmactsoxmit() estimates the number of free TX descriptors required by a TSO skb as:
(skb->len - protohdrlen) / TSOMAXBUFFSIZE + 1
which assumes the payload is split into TSOMAXBUFFSIZE chunks. This underestimates the descriptors actually consumed by stmmactsoallocator(), since each fragment is mapped individually and so it needs at least one descriptor regardless of its size. Moreover, one descriptor is used for the L2/L3/L4 headers and, when the MSS changes, one more is consumed for the MSS context descriptor. For a highly fragmented TSO skb the check can therefore pass even when the ring has too few free slots. stmmactsoallocator() then writes past the available descriptors, overwriting descriptors still owned by the DMA engine, corrupting the TX ring. Add stmmactsogetnumdesc() to compute the exact number of descriptors needed for the header, the linear payload and each fragment, plus the MSS context descriptor when required, and use it in the availability check.
Affected Software
Event History
Frequently Asked Questions
What traffic pattern is needed to trigger the corruption?
The issue is triggered by TSO traffic using a highly fragmented socket buffer. The descriptor pre-check can underestimate the space required because each fragment needs its own descriptor, in addition to header handling and potentially an MSS context descriptor.
What condition makes the transmit ring unsafe?
The unsafe condition occurs when the available TX descriptors are fewer than the number actually consumed by stmmac_tso_allocator(), despite passing the original availability check. The allocator can then overwrite descriptors still owned by the DMA engine, corrupting the TX ring.
Does MSS handling affect exploitability?
Yes. When the MSS changes, transmission consumes an additional MSS context descriptor, which the prior estimate did not account for. This further increases the gap between the checked and actual descriptor requirement.
What does the fix change?
The fix adds stmmac_tso_get_num_desc() and uses it for the availability check. It counts descriptors for headers, linear payload, every fragment, and an MSS context descriptor when required.