CVE-2026-98571: net: stmmac: clear stale buf->page after recycling on skb build failure
In the Linux kernel, the following vulnerability has been resolved:
net: stmmac: clear stale buf->page after recycling on skb build failure
In stmmacrx(), when napibuildskb() fails the descriptor page is recycled back to the page pool with pagepoolrecycledirect(), but buf->page is left pointing at the recycled page, unlike every other consumption site in the function which clears the pointer after handing the page away.
With the stale pointer stmmacrxrefill() skips the replacement allocation and programs the already-recycled page back into the RX descriptor.
Clear buf->page on the napibuildskb() failure path to keep the buffer lifecycle consistent with the other consumption sites.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel stmmac network driver are affected when the receive path reaches a napi_build_skb() allocation failure. The issue concerns RX descriptor and page-pool handling in that driver.
What condition is required to trigger the flaw?
napi_build_skb() must fail while stmmac_rx() is processing a received buffer. That failure causes the page to be recycled while a stale buf->page pointer remains, allowing refill logic to reuse the recycled page.
How can I tell whether the fix is present?
Check the stmmac_rx() napi_build_skb() failure path. A fixed kernel clears buf->page after page_pool_recycle_direct() hands the descriptor page back to the page pool.
What is the mitigation if an updated kernel cannot be deployed immediately?
The provided information does not identify a configuration workaround. Reducing conditions that cause skb-building allocation failures may reduce exposure, but the described correction is to clear buf->page in the failure path.