CVE-2026-98803: net: stmmac: fix rx Scatter-Gather support
In the Linux kernel, the following vulnerability has been resolved:
net: stmmac: fix rx Scatter-Gather support
When a received frame is larger than dmabufsz, the DMA scatters it across multiple RX descriptors (rx Scatter-Gather). The secondary RX buffer (secpage) was only allocated and programmed when split-header (SPH) was active, so for regular frames buffer2 was neither allocated nor backed by a valid mapping. As soon as an incoming frame overflowed buffer1, the DMA wrote the overflow into the unmapped secondary-buffer address, triggering an SMMU translation fault on IOMMU-based platforms:
arm-smmu 15000000.iommu: Unhandled context fault: fsr=0x402, iova=0x00000000, fsynr=0x7f0011, cbfrsynra=0x1c90, cb=11 arm-smmu 15000000.iommu: FSR = 00000402 [Format=2 TF], SID=0x1c90 arm-smmu 15000000.iommu: FSYNR0 = 007f0011 [S1CBNDX=127 WNR PLVL=1]
Enable scatter-gather for non-SPH frames on cores that can program an independent secondary RX buffer (GMAC4/XGMAC): allocate and mark buffer2 as valid in stmmacinitrxbuffers() and stmmacrxrefill(), and account for it in the buffer length computation. Legacy cores have no setsecaddr op, so they keep buffer2 disabled.
Since buffer2 is handed to the DMA at page offset 0, the page pool sync window is widened to cover both buffers in every mode: offset is set to 0 and maxlen to dmabufsz + stmmacrxoffset().
The FCS can straddle the buffer1/buffer2 boundary and a descriptor boundary, so it is now stripped from the tail of the assembled frame with pskbtrim() instead of from a single buffer, avoiding an unsigned underflow for frames that overflow a buffer by 1..3 bytes. For single-buffer frames the XDP program must not see the FCS, so it is removed from the XDP buffer before the program runs.
Native XDP currently only supports single-buffer (linear) frames. An oversized frame accepted by the MAC (jumbo enabled) is received via buffer2; the XDP program only sees buffer1, so on a TX/REDIRECT verdict the frame is forwarded truncated. XDP multi-buffer support to handle this case is planned as a follow-up.
AFXDP zero-copy RX is not covered by this change: a ZC queue still programs buffer2 at DMA address 0 (and XGMAC has no buffer2-valid bit), so an oversized frame overflowing buffer1 can still trigger the same SMMU translation fault. Handling is planned as a follow-up.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Enable scatter-gather for non-SPH frames on GMAC4/XGMAC cores that support an independent secondary RX buffer; allocate and mark buffer2 as valid in stmmac_init_rx_buffers() and stmmac_rx_refill(), and include buffer2 in the buffer-length computation.
Linux kernel net: stmmac scatter-gather for non-SPH frames = enabled
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the stmmac driver on GMAC4 or XGMAC cores can be affected when receiving non-split-header frames that exceed dma_buf_sz. The reported failure occurs on IOMMU-based platforms, where the invalid secondary-buffer DMA address causes an SMMU translation fault.
What traffic condition triggers the fault?
A received frame must be larger than the primary DMA buffer size, causing DMA to scatter the frame across multiple RX descriptors. On affected non-SPH configurations, the overflow can be written to an unmapped secondary-buffer address.
Are legacy stmmac cores affected in the same way?
No. Legacy cores without a set_sec_addr operation keep the secondary RX buffer disabled; the fix specifically enables and configures it for GMAC4/XGMAC cores that support an independent secondary RX buffer.
How can I identify a system already experiencing this problem?
Look for SMMU or IOMMU context-fault logs during packet reception, including messages such as "Unhandled context fault" and a translation fault involving IOVA 0x00000000. These faults can occur when a received frame overflows the first RX buffer.