HIGH Introduced in 6.14
stmmac RxRefill UAF
CVE-2026-98571
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: clear stale buf->page after recycling on skb build failure In stmmac_rx(), when napi_build_skb() fails the descriptor page is recycled back to the page pool with page_pool_recycle_direct(), but buf->page is left pointing at the recycled page, unlike every other consumption site in the function which clears the pointer after handing the page away. With the stale pointer stmmac_rx_refill() skips the replacement allocation and programs the already-recycled page back into the RX descriptor. Clear buf->page on the napi_build_skb() failure path to keep the buffer lifecycle consistent with the other consumption sites.
02KernelScan AI Analysis
Risk summary
A remote attacker sending network packets to an stmmac Ethernet interface can trigger a use-after-free condition when the driver fails to build an skb under memory pressure. This leads to a page being recycled to the pool while a stale pointer remains, causing the same page to be programmed into the RX descriptor twice. Exploitation can result in kernel memory corruption, information disclosure, and system crash.
Vulnerability analysis
In the stmmac Ethernet driver's receive path, when the kernel fails to build a socket buffer due to memory allocation failure, the received page is correctly returned to the page pool but the buffer's page pointer is not cleared. This leaves a stale pointer referencing a page that has been released back to the allocator. During the next refill cycle, the driver sees the non-NULL pointer and skips allocating a new page, instead reusing the already-recycled page in the RX descriptor. This creates a use-after-free condition where the same physical page can be simultaneously managed by the page pool and the DMA descriptor, leading to memory corruption, potential data leaks, and kernel crashes. The fix clears the buffer's page pointer after recycling, aligning this error path with all other consumption sites in the function. The vulnerability is reachable from the network by any sender capable of delivering packets to the stmmac interface; triggering the allocation failure requires memory pressure, which an attacker may influence by flooding packets but cannot directly control.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.14 | 6.18.55 | 501baaeca7d1 |
| 7.2 | 6.14 | 7.2.9 | 298673397ea3 |
| mainline | 6.14 | 7.3 | 0a7822e34a0b |