VulnerabilityPublished 18 Oct 2026

CVE-2026-98803: Linux kernel · net: stmmac: fix rx Scatter-Gather support

Source GCVE Database

Authoritative record:CVE-2026-98803· Medium

Not known to be exploited · fixed in a7cff44543f66f3a19151060cb549691d191d44c : update Linux kernel when convenient.

Data as of 26 Oct 2026, 14:05 UTC

Severity

Medium

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 5% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in a7cff44543f66f3a19151060cb549691d191d44c, 88095728511e0df9c89528944f5a1762ad298983, 358d5ac5a5d57ce21c3814c4e3e8f3fbcb7304b4 +1

Exploitation evidence

Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-p8jr-c4h2-2vmv

What to do

Upgrade Linux kernel to a7cff44543f66f3a19151060cb549691d191d44c, 88095728511e0df9c89528944f5a1762ad298983, 358d5ac5a5d57ce21c3814c4e3e8f3fbcb7304b4 or 5.5.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected >=5.4.262 <5.5	Fixed in a7cff44543f66f3a19151060cb549691d191d44c 88095728511e0df9c89528944f5a1762ad298983 358d5ac5a5d57ce21c3814c4e3e8f3fbcb7304b4 5.5
LinuxLinux	Affected =5.5	Fixed in–

AI-suggested

A fix has been implemented in the Linux kernel to properly allocate and validate the secondary RX buffer for non-split-header frames on supported cores, resolving the SMMU translation fault issue. Users should update to the fixed Linux kernel version containing this patch. Note that AF_XDP zero-copy RX scenarios are not yet fixed and may still cause faults; handling for these cases is planned in future updates. No additional mitigation is required for legacy cores or split-header frames as they are not affected.

Description

A vulnerability in the Linux kernel's stmmac network driver related to RX Scatter-Gather support has been resolved. The issue occurs when a received frame larger than the DMA buffer size is scattered across multiple RX descriptors, but the secondary RX buffer was not properly allocated or mapped for regular frames. This causes DMA to write to an unmapped secondary buffer address, triggering an SMMU translation fault on IOMMU-based platforms. The fix enables scatter-gather support for non-split-header frames on capable cores by properly allocating and validating the secondary buffer and adjusting buffer length computations. Some related cases, such as AF_XDP zero-copy RX, remain unaddressed and are planned for future fixes.

Impact

On affected systems, receiving frames larger than the DMA buffer size could cause the DMA engine to write to an unmapped memory area, triggering SMMU translation faults on IOMMU-based platforms. This could lead to network packet processing errors or system instability related to the network driver. The vulnerability affects network functionality on platforms using the stmmac driver with certain hardware cores that support secondary RX buffers. Legacy cores without this capability are not impacted. The issue does not appear to be exploitable for code execution or data corruption beyond causing faults in the IOMMU.

References

Community reviews

Loading reviews…