CVE-2026-31658: Linux kernel · net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit()
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in d5ec406f0543bd6cdfd563b08015fdec8c4d5712 : update Linux kernel when convenient.
Data as of 10 Nov 2026, 13:05 UTC
Rated Medium by Threat Radar's AI analysis · No CVSS score from NVD or the CNA
Thin evidence
One scorer or none- Patch
- Available – fixed in d5ec406f0543bd6cdfd563b08015fdec8c4d5712, cb1d318702fdf643061350d164250198df4116f2, ae2cd46f57f422b51aedd406ff5d75cbff401d5d +5
Exploitation evidence
Disclosed: evidence found.
CVE published 24 Apr 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 10 Nov 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
AI-suggested
This issue has been fixed in the Linux kernel. Users should apply the official patch or upgrade to a fixed kernel version containing the commit hashes listed in the established facts. No additional mitigation is required once the fix is applied.
Description
A memory leak vulnerability was identified and fixed in the Linux kernel's altera-tse network driver. The issue occurs when dma_map_single() fails in the tse_start_xmit() function, causing the function to return NETDEV_TX_OK without freeing the socket buffer (skb). This results in the skb never being freed, leaking memory on each DMA mapping failure. The fix adds a call to dev_kfree_skb_any() to properly free the skb before returning.
References
- git.kernel.org/stable/c/ae2cd46f57f422b51aedd406ff5d75cbff401d5d (opens in a new tab)
- git.kernel.org/stable/c/cb1d318702fdf643061350d164250198df4116f2 (opens in a new tab)
- git.kernel.org/stable/c/d5ec406f0543bd6cdfd563b08015fdec8c4d5712 (opens in a new tab)
- git.kernel.org/stable/c/2eb9d67704ca8f1101f7435b85f113ede471f9f2 (opens in a new tab)
- git.kernel.org/stable/c/9f3ec44aeb58501d11834048d5d0dbaeacb6d4e7 (opens in a new tab)
- git.kernel.org/stable/c/60f462cd2716d86bd2174f9d5e035c9278f30480 (opens in a new tab)
- git.kernel.org/stable/c/3aca300e88afe56afb000cdc4c65383014fb17f9 (opens in a new tab)
- git.kernel.org/stable/c/6dede3967619b5944003227a5d09fdc21ed57d10 (opens in a new tab)
- cert-portal.siemens.com/productcert/html/ssa-082556.html (opens in a new tab)
- cert-portal.siemens.com/productcert/html/ssa-019113.html (opens in a new tab)
- cert-portal.siemens.com/productcert/html/ssa-457936.html (opens in a new tab)