In the Linux kernel, the following vulnerability has been resolved: net: spacemit: clear TX descriptor on fragment mapping failure emac_tx_mem_map()… (CVE-2026-98592)

The Linux kernel spacemit network driver had a flaw in emac_tx_mem_map() where TX_DESC_0_OWN was set on descriptors before all fragments were mapped. On fragment mapping failure, the cleanup path (err_free_skb) unmaps buffers but leaves the descriptor memory uncleared and does not advance the tx_ring->head pointer. This results in descriptors with stale DMA addresses being considered free by software but still owned by hardware, potentially causing the DMA engine to access invalid memory. The patch aligns the mapping failure path with the descriptor cleanup logic to clear descriptors properly.

The vulnerability can lead to the DMA engine fetching stale, unmapped buffer addresses, which may cause data corruption or undefined behavior in the network driver. This could affect network packet transmission reliability and system stability. There is no indication of remote code execution or privilege escalation from the provided data.

A fix has been implemented to clear TX descriptors on fragment mapping failure in the Linux kernel spacemit driver. Users should apply the official kernel update that includes this patch. No additional mitigation steps are indicated.