CVE-2026-98131: net: stmmac: fix dma mapping leak in stmmac_tso_xmit()
In the Linux kernel, the following vulnerability has been resolved:
net: stmmac: fix dma mapping leak in stmmactsoxmit()
In stmmactsoxmit(), if the DMA mapping of an skb fragment fails, the frame is dropped but the DMA mappings already created for the linear part and for the fragments mapped before the failure are never unmapped, leaking DMA mappings.
Fix the leak by walking back over the descriptors used by the frame and releasing each of them with stmmacfreetxbuffer(). Moreover, release the descriptors with stmmacreleasetxdesc() unmapping the DMA buffers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In stmmac_tso_xmit(), when DMA mapping of an skb fragment fails, walk back over the descriptors used by the frame, call stmmac_release_tx_desc() to unmap the DMA buffers, and release each descriptor with stmmac_free_tx_buffer().
Event History
Frequently Asked Questions
Which systems are exposed to this DMA mapping leak?
Systems using the Linux kernel stmmac network driver are exposed when transmitting traffic through the TSO transmit path. The issue occurs if DMA mapping fails for an skb fragment after mappings have already been created for the linear portion or earlier fragments.
What condition is required to trigger the leak?
A DMA mapping operation for an skb fragment must fail during stmmac_tso_xmit(). The failed frame is dropped, but prior DMA mappings for that frame remain mapped in the affected code.
What happens if the condition is triggered repeatedly?
Each affected failure can leave DMA mappings allocated for the linear data and any fragments mapped before the failure. Repeated failures can therefore accumulate leaked DMA mappings.
How is the issue fixed?
The fix walks back through the descriptors used by the failed frame and releases their DMA buffers with stmmac_free_tx_buffer(). It also releases the descriptors with stmmac_release_tx_desc().