{"id":"CVE-2026-98803","summary":"net: stmmac: fix rx Scatter-Gather support","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: fix rx Scatter-Gather support\n\nWhen a received frame is larger than dma_buf_sz, the DMA scatters it\nacross multiple RX descriptors (rx Scatter-Gather). The secondary RX\nbuffer (sec_page) was only allocated and programmed when split-header\n(SPH) was active, so for regular frames buffer2 was neither allocated\nnor backed by a valid mapping. As soon as an incoming frame overflowed\nbuffer1, the DMA wrote the overflow into the unmapped secondary-buffer\naddress, triggering an SMMU translation fault on IOMMU-based platforms:\n\narm-smmu 15000000.iommu: Unhandled context fault: fsr=0x402, iova=0x00000000, fsynr=0x7f0011, cbfrsynra=0x1c90, cb=11\narm-smmu 15000000.iommu: FSR    = 00000402 [Format=2 TF], SID=0x1c90\narm-smmu 15000000.iommu: FSYNR0 = 007f0011 [S1CBNDX=127 WNR PLVL=1]\n\nEnable scatter-gather for non-SPH frames on cores that can program an\nindependent secondary RX buffer (GMAC4/XGMAC): allocate and mark buffer2\nas valid in stmmac_init_rx_buffers() and stmmac_rx_refill(), and account\nfor it in the buffer length computation. Legacy cores have no set_sec_addr\nop, so they keep buffer2 disabled.\n\nSince buffer2 is handed to the DMA at page offset 0, the page pool sync\nwindow is widened to cover both buffers in every mode: offset is set to 0\nand max_len to dma_buf_sz + stmmac_rx_offset().\n\nThe FCS can straddle the buffer1/buffer2 boundary and a descriptor\nboundary, so it is now stripped from the tail of the assembled frame with\npskb_trim() instead of from a single buffer, avoiding an unsigned underflow\nfor frames that overflow a buffer by 1..3 bytes. For single-buffer frames\nthe XDP program must not see the FCS, so it is removed from the XDP buffer\nbefore the program runs.\n\nNative XDP currently only supports single-buffer (linear) frames. An\noversized frame accepted by the MAC (jumbo enabled) is received via\nbuffer2; the XDP program only sees buffer1, so on a TX/REDIRECT verdict\nthe frame is forwarded truncated. XDP multi-buffer support to handle\nthis case is planned as a follow-up.\n\nAF_XDP zero-copy RX is not covered by this change: a ZC queue still\nprograms buffer2 at DMA address 0 (and XGMAC has no buffer2-valid bit),\nso an oversized frame overflowing buffer1 can still trigger the same\nSMMU translation fault. Handling is planned as a follow-up.","modified":"2026-10-19T02:47:25.550733438Z","published":"2026-10-18T15:48:50.108Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98803.json","cna_assigner":"Linux"},"references":[{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"},{"type":"WEB","url":"https://git.kernel.org/stable/c/358d5ac5a5d57ce21c3814c4e3e8f3fbcb7304b4"},{"type":"WEB","url":"https://git.kernel.org/stable/c/88095728511e0df9c89528944f5a1762ad298983"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a7cff44543f66f3a19151060cb549691d191d44c"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98803.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98803"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"88ebe2cf7f3fc9da95e0f06483fd58da3e67e675"},{"fixed":"358d5ac5a5d57ce21c3814c4e3e8f3fbcb7304b4"},{"fixed":"a7cff44543f66f3a19151060cb549691d191d44c"},{"fixed":"88095728511e0df9c89528944f5a1762ad298983"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"5.4.262"},{"fixed":"5.5"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"c4b712d1a814a0535091d99e6cf04d69ac42ef7b"}]}],"versions":["v5.4.302","v5.4.301","v5.4.300","v5.4.299","v5.4.298","v5.4.297","v5.4.296","v5.4.295","v5.4.294","v5.4.293","v5.4.292","v5.4.291","v5.4.290","v5.4.289","v5.4.288","v5.4.287","v5.4.286","v5.4.285","v5.4.284","v5.4.283","v5.4.282","v5.4.281","v5.4.280","v5.4.279","v5.4.278","v5.4.277","v5.4.276","v5.4.275","v5.4.274","v5.4.273","v5.4.272","v5.4.271","v5.4.270","v5.4.269","v5.4.268","v5.4.267","v5.4.266","v5.4.265","v5.4.264","v5.4.263","v5.4.262"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98803.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.0"},{"fixed":"6.18.56"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.10"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98803.json"}}],"schema_version":"1.9.0"}