UBUNTU-CVE-2026-98592: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: net: spacemit: clear TX descriptor on fragment mapping failure emactxmemmap() writes TXDESC0OWN into the ring descriptor for every slot beyond oldhead as soon as that slot's memset()'d local copy is committed with "txdescaddr = txdesc", i.e. before the buffers for that slot have necessarily all been mapped successfully. If emactxmapfrag() then fails on a later fragment, the errfreeskb path calls emacfreetxbuf() to unmap and drop the skb, but leaves the already-written descriptor memory untouched, and txring->head is never advanced past oldhead (the "txring->head = head" store is skipped by the goto). So a slot between oldhead and the rolled-back head can be left with TXDESC0OWN set and bufferaddr{1,2} pointing at DMA mappings that emacfreetxbuf() just tore down, while software considers that slot free again. The next successful emactxmemmap() call only rebuilds oldhead itself; if the DMA engine auto-advances into the following descriptor once it finishes oldhead's packet, it will fetch that stale, already-unmapped address. emactxcleandesc() already treats emacfreetxbuf() and clearing the descriptor as a pair when reclaiming completed descriptors; do the same in the mapping failure path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the emac_tx_mem_map() fragment-mapping failure path (err_free_skb), pair emac_free_tx_buf() with clearing the affected TX descriptor, including descriptors between old_head and the rolled-back head, so TX_DESC_0_OWN and stale buffer_addr_1/buffer_addr_2 DMA mappings are removed before the slot is reused.
Event History
Frequently Asked Questions
What level of access does an attacker need?
The CVSS vector indicates local access and low privileges are required. No user interaction is required, and the attack complexity is rated low.
Which Ubuntu kernel package families are identified as affected?
The listed packages are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-hwe-edge, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, and ubuntu/linux-aws-5.0.