CVE-2026-97953

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

• https://git.kernel.org/stable/c/5e38d732ec67a5b1f9a56e6c73add480c4b6030a 416baaa9-dc9f-4396-8d5f-8c081fb06d67
• https://git.kernel.org/stable/c/65820fc743eae322f7f94f6a64d07861211d4b21 416baaa9-dc9f-4396-8d5f-8c081fb06d67
• https://git.kernel.org/stable/c/c28175220f808c867d5618de8ecc6dbcc815c773 416baaa9-dc9f-4396-8d5f-8c081fb06d67
• https://git.kernel.org/stable/c/ffa6d2481bc1c87f822ecd626561484e4ee24cef 416baaa9-dc9f-4396-8d5f-8c081fb06d67

The full cvelistV5 record. Download as CVE-2026-97953.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ffa6d2481bc1c87f822ecd626561484e4ee24cef",
              "status": "affected",
              "version": "f748be531d7012c456b97f66091d86b3675c5fef",
              "versionType": "git"
            },
            {
              "lessThan": "c28175220f808c867d5618de8ecc6dbcc815c773",
              "status": "affected",
              "version": "f748be531d7012c456b97f66091d86b3675c5fef",
              "versionType": "git"
            },
            {
              "lessThan": "65820fc743eae322f7f94f6a64d07861211d4b21",
              "status": "affected",
              "version": "f748be531d7012c456b97f66091d86b3675c5fef",
              "versionType": "git"
            },
            {
              "lessThan": "5e38d732ec67a5b1f9a56e6c73add480c4b6030a",
              "status": "affected",
              "version": "f748be531d7012c456b97f66091d86b3675c5fef",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "lessThan": "4.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc3",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: fix TX descriptor availability check for TSO traffic\n\nstmmac_tso_xmit() estimates the number of free TX descriptors required by\na TSO skb as:\n\n\t(skb->len - proto_hdr_len) / TSO_MAX_BUFF_SIZE + 1\n\nwhich assumes the payload is split into TSO_MAX_BUFF_SIZE chunks. This\nunderestimates the descriptors actually consumed by stmmac_tso_allocator(),\nsince each fragment is mapped individually and so it needs at least one\ndescriptor regardless of its size. Moreover, one descriptor is used for\nthe L2/L3/L4 headers and, when the MSS changes, one more is consumed for\nthe MSS context descriptor.\nFor a highly fragmented TSO skb the check can therefore pass even when the\nring has too few free slots. stmmac_tso_allocator() then writes past the\navailable descriptors, overwriting descriptors still owned by the DMA\nengine, corrupting the TX ring.\nAdd stmmac_tso_get_num_desc() to compute the exact number of descriptors\nneeded for the header, the linear payload and each fragment, plus the MSS\ncontext descriptor when required, and use it in the availability check."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - On a stmmac router or bridge, a remote sender's TCP segments are merged by GRO (payload left in the linear head plus up to 17 fragments) and forwarded to stmmac_tso_xmit(). Flows with different segment sizes also force an MSS context descriptor. The old check, (skb->len - proto_hdr_len)/TSO_MAX_BUFF_SIZE + 1, asks for 1 descriptor where 20 are written, so the remote packets themselves shape the skb that overruns the ring.\nAC:H - The overrun happens only when the queue is awake with stmmac_tx_avail() just under the real count (about 19 free for a 20-descriptor skb), and remotely it also needs the host to forward traffic and the ingress NIC to keep payload in the linear head. The attacker can flood toward that window and retry but cannot set ring occupancy exactly, and other traffic changes it.\nPR:N - No authentication is involved: GRO merging and IP forwarding/bridging to the stmmac egress port accept any sender's packets, and TSO is used for any forwarded GSO skb that passes stmmac_tso_valid_packet() (gso_size >= 64).\nUI:N - Nobody on the target has to do anything. The attacker's own flows produce the fragmented GSO skbs and fill the TX ring during normal forwarding.\nS:U - The damage stays inside the host kernel's stmmac TX ring and its bookkeeping (tx_skbuff[], tx_skbuff_dma[]). No VM, IOMMU or sandbox boundary is crossed.\nC:L - Once cur_tx catches up with dirty_tx, later sends overwrite descriptors the DMA engine still owns. Frames can then carry the wrong buffers or buffers already released by stmmac_tx_clean(), a limited, uncontrolled leak of data from other flows or memory. It gives no arbitrary read.\nI:L - Overwritten live descriptors garble other flows' outgoing frames (payload chunks swapped into the wrong TSO frame) and corrupt the driver's per-entry skb and DMA bookkeeping. The device only reads memory for TX, so there is no general kernel memory write.\nA:H - After the extra write makes the ring look empty (cur_tx == dirty_tx), completed skbs and DMA mappings are never reclaimed and later sends overwrite in-flight descriptors, triggering WARN_ONs, a TX stall, the netdev watchdog timeout and an interface reset. The attacker can repeat this at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T14:41:44.252Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ffa6d2481bc1c87f822ecd626561484e4ee24cef"
        },
        {
          "url": "https://git.kernel.org/stable/c/c28175220f808c867d5618de8ecc6dbcc815c773"
        },
        {
          "url": "https://git.kernel.org/stable/c/65820fc743eae322f7f94f6a64d07861211d4b21"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e38d732ec67a5b1f9a56e6c73add480c4b6030a"
        }
      ],
      "title": "net: stmmac: fix TX descriptor availability check for TSO traffic",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97953",
    "datePublished": "2026-09-25T10:23:00.758Z",
    "dateReserved": "2026-09-25T10:18:58.205Z",
    "dateUpdated": "2026-09-25T14:41:44.252Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}