Description

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TX descriptor availability check for TSO traffic stmmac_tso_xmit() estimates the number of free TX descriptors required by a TSO skb as: (skb->len - proto_hdr_len) / TSO_MAX_BUFF_SIZE + 1 which assumes the payload is split into TSO_MAX_BUFF_SIZE chunks. This underestimates the descriptors actually consumed by stmmac_tso_allocator(), since each fragment is mapped individually and so it needs at least one descriptor regardless of its size. Moreover, one descriptor is used for the L2/L3/L4 headers and, when the MSS changes, one more is consumed for the MSS context descriptor. For a highly fragmented TSO skb the check can therefore pass even when the ring has too few free slots. stmmac_tso_allocator() then writes past the available descriptors, overwriting descriptors still owned by the DMA engine, corrupting the TX ring. Add stmmac_tso_get_num_desc() to compute the exact number of descriptors needed for the header, the linear payload and each fragment, plus the MSS context descriptor when required, and use it in the availability check.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.0",
  "pubDate": "2026-09-25T11:17:22.930Z",
  "pubdate": "2026-09-25T11:17:22.930Z",
  "executiveSummary": "The Linux kernel stmmac driver contains a vulnerability in the TSO (TCP Segmentation Offload) descriptor management logic, leading to a heap-based buffer overflow within the TX descriptor ring.\nThe issue stems from an incorrect calculation of the required number of TX descriptors for fragmented TSO packets, causing the driver to underestimate the required slots.\nThis mismatch allows the stmmac_tso_allocator() function to write beyond the bounds of the available ring buffer, overwriting active descriptors currently being processed by the DMA engine.\nThe vulnerability poses a critical impact, potentially leading to system instability, kernel panics, or arbitrary memory corruption if the DMA engine interprets malicious or malformed descriptor data.\nExploitation requires the attacker to send specially crafted, highly fragmented TSO traffic that triggers the driver's faulty resource accounting logic.\nThe vulnerability affects systems utilizing the stmmac network driver, which is commonly found in various embedded platforms and SoC network interfaces.",
  "technicalDetails": "The root cause of the vulnerability lies within the stmmac_tso_xmit() function's descriptor requirement estimation logic. Previously, the driver estimated the number of TX descriptors needed by calculating (skb->len - proto_hdr_len) / TSO_MAX_BUFF_SIZE + 1. This formula incorrectly assumes that the payload will always be neatly segmented into maximum-sized buffers.\nIn reality, the stmmac_tso_allocator() function maps each individual fragment of the skb to a descriptor. Since each fragment requires at least one descriptor regardless of its size, the simple arithmetic approach significantly underestimates total descriptor consumption, particularly for highly fragmented skbs. Furthermore, the calculation fails to account for the L2/L3/L4 header descriptor and the potential requirement for an additional MSS context descriptor when the MSS value changes.\nThe attack flow proceeds as follows: An attacker sends a series of fragmented TSO packets designed to maximize fragment count while minimizing size. The faulty availability check in stmmac_tso_xmit() incorrectly validates that the TX ring has sufficient slots because the estimated count is lower than the actual required count. The stmmac_tso_allocator() then proceeds to allocate descriptors based on the incorrect assumption.\nWhen the allocator writes these descriptors into the ring, it exceeds the intended bounds, overwriting segments of the TX ring that are either currently being processed by the DMA engine or are awaiting processing. This memory corruption causes the DMA engine to fetch invalid or attacker-influenced descriptor data.\nThe post-exploitation impact includes DMA engine misconfiguration or corruption of memory associated with legitimate network traffic. Because the DMA engine operates with high privileges, this can lead to system crashes (DoS) or unexpected data leaks. No specific authentication is required to trigger this as it is reached via standard network stack processing of incoming/outgoing traffic, making it a significant concern for network-exposed devices using the affected stmmac driver."
}