In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix rx Scatter-Gather support When a received frame is larger than… (CVE-2026-98803)

The Linux kernel stmmac driver had a vulnerability where frames larger than the DMA buffer size caused DMA to write overflow data into an unmapped secondary RX buffer address, leading to SMMU translation faults on IOMMU platforms. This was due to the secondary RX buffer only being allocated when split-header mode was active, leaving it unallocated for regular frames. The fix involves enabling scatter-gather support for non-split-header frames on cores that support an independent secondary RX buffer by allocating and marking the secondary buffer as valid, adjusting buffer length calculations, and properly handling frame checksums that straddle buffer boundaries. Legacy cores without the secondary buffer capability remain unaffected. The fix does not yet cover AF_XDP zero-copy RX scenarios, which can still trigger faults and are planned to be addressed later.

On affected systems, receiving frames larger than the DMA buffer size could cause the DMA engine to write to an unmapped memory area, triggering SMMU translation faults on IOMMU-based platforms. This could lead to network packet processing errors or system instability related to the network driver. The vulnerability affects network functionality on platforms using the stmmac driver with certain hardware cores that support secondary RX buffers. Legacy cores without this capability are not impacted. The issue does not appear to be exploitable for code execution or data corruption beyond causing faults in the IOMMU.

A fix has been implemented in the Linux kernel to properly allocate and validate the secondary RX buffer for non-split-header frames on supported cores, resolving the SMMU translation fault issue. Users should update to the fixed Linux kernel version containing this patch. Note that AF_XDP zero-copy RX scenarios are not yet fixed and may still cause faults; handling for these cases is planned in future updates. No additional mitigation is required for legacy cores or split-header frames as they are not affected.