All vulnerabilities
CVE-2026-98131

Linux: net: stmmac: fix dma mapping leak in stmmac_tso_xmit()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.12%Chance of exploitation activity in the next 30 days, higher than 1% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in8a3257f142ae513d0c96d42f97386d4941bcec29Fixed versionCVE List
Published25 Sep 2026Updated 21 Oct 2026CVE List

What fixes it

  • 8a3257f142ae513d0c96d42f97386d4941bcec29LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

net: stmmac: fix dma mapping leak in stmmac_tso_xmit()

In stmmac_tso_xmit(), if the DMA mapping of an skb fragment fails, the frame is dropped but the DMA mappings already created for the linear part and for the fragments mapped before the failure are never unmapped, leaking DMA mappings.

Fix the leak by walking back over the descriptors used by the frame and releasing each of them with stmmac_free_tx_buffer(). Moreover, release the descriptors with stmmac_release_tx_desc() unmapping the DMA buffers.

Text from CVE List

Affected versions 10

  • Linuxaffected: f748be531d7012c456b97f66091d86b3675c5fef before c5449b635362cb678d29d8f6ab54e65734d891ceCVE List
  • Linuxaffected: f748be531d7012c456b97f66091d86b3675c5fef before 8a3257f142ae513d0c96d42f97386d4941bcec29CVE List
  • Linuxaffected: f748be531d7012c456b97f66091d86b3675c5fef before e85adaac3dc6317cae902372c6849189ec62cf7dCVE List
  • Linuxaffected: f748be531d7012c456b97f66091d86b3675c5fef before a5d946466a95621fa2769720d59ea336003aa1a5CVE List
  • Linuxaffected: 4.7CVE List
  • Linuxunaffected: all versions before 4.7CVE List
  • Linuxunaffected: 6.12.114 through 6.12.*CVE List
  • Linuxunaffected: 6.18.57 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 4