CVE-2026-98131: net: stmmac: fix dma mapping leak in stmmac_tso_xmit()
In the Linux kernel, the following vulnerability has been resolved:
net: stmmac: fix dma mapping leak in stmmactsoxmit()
In stmmactsoxmit(), if the DMA mapping of an skb fragment fails, the frame is dropped but the DMA mappings already created for the linear part and for the fragments mapped before the failure are never unmapped, leaking DMA mappings.
Fix the leak by walking back over the descriptors used by the frame and releasing each of them with stmmacfreetxbuffer(). Moreover, release the descriptors with stmmacreleasetxdesc() unmapping the DMA buffers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.7-1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.3-1 - Compensating control
In stmmac_tso_xmit(), when DMA mapping an skb fragment fails, walk back over the descriptors already used by the frame and release each with stmmac_free_tx_buffer(); use stmmac_release_tx_desc() to unmap the DMA buffers.
Event History
Frequently Asked Questions
Which systems are exposed to this DMA mapping leak?
Systems using the Linux kernel stmmac network driver are exposed when transmitting traffic through the TSO transmit path. The issue occurs if DMA mapping fails for an skb fragment after mappings have already been created for the linear portion or earlier fragments.
What condition is required to trigger the leak?
A DMA mapping operation for an skb fragment must fail during stmmac_tso_xmit(). The failed frame is dropped, but prior DMA mappings for that frame remain mapped in the affected code.
What happens if the condition is triggered repeatedly?
Each affected failure can leave DMA mappings allocated for the linear data and any fragments mapped before the failure. Repeated failures can therefore accumulate leaked DMA mappings.
How is the issue fixed?
The fix walks back through the descriptors used by the failed frame and releases their DMA buffers with stmmac_free_tx_buffer(). It also releases the descriptors with stmmac_release_tx_desc().