CVE-2026-98803: Linux kernel · net: stmmac: fix rx Scatter-Gather support
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in a7cff44543f66f3a19151060cb549691d191d44c : update Linux kernel when convenient.
Data as of 26 Oct 2026, 14:05 UTC
Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 5% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in a7cff44543f66f3a19151060cb549691d191d44c, 88095728511e0df9c89528944f5a1762ad298983, 358d5ac5a5d57ce21c3814c4e3e8f3fbcb7304b4 +1
Exploitation evidence
Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade Linux kernel to a7cff44543f66f3a19151060cb549691d191d44c, 88095728511e0df9c89528944f5a1762ad298983, 358d5ac5a5d57ce21c3814c4e3e8f3fbcb7304b4 or 5.5.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
AI-suggested
A fix for this vulnerability is available and included in Linux kernel version 5.5. Users should upgrade to version 5.5 or later to remediate the issue. The vendor has implemented proper allocation and handling of the secondary RX buffer for non-split-header frames on supported cores. No additional mitigation actions are indicated or required beyond applying the official fix.
Description
A vulnerability in the Linux kernel's stmmac network driver affects the handling of received frames larger than the DMA buffer size. The flaw causes the DMA to write overflow data into an unmapped secondary buffer address, triggering an SMMU translation fault on IOMMU-based platforms. This occurs because the secondary RX buffer was not allocated for regular frames, only when split-header mode was active. The issue has been fixed by enabling scatter-gather support for non-split-header frames on certain cores, properly allocating and marking the secondary buffer as valid, and adjusting buffer length computations and frame trimming.