Linux Kernel CVE-2026-63857

The flaw resides in the airoha_eth driver, which supports the packet-processing engine (PPE/QDMA) on Airoha/MediaTek EN7581 and related router-class SoCs. In airoha_dev_xmit() the scatter-gather transmit loop iterates over skb_shinfo(skb)->nr_frags fragments; on the terminating iteration (index == nr_frags) it dereferences fragment metadata that has not yet been populated, reading an uninitialized DMA/fragment address. The fix avoids the fragment read on the last iteration and moves the skb pointer from the first to the last used TX descriptor so airoha_qdma_tx_napi_poll() defers freeing the skb until the final descriptor is processed, preventing both the bad read and premature buffer release. The root cause is a classic use-of-uninitialized/out-of-bounds-adjacent read (CWE-457/CWE-125 class); the CWE field in the source data is N/A. Despite the 'Information Disclosure' tag, the description states the values are never consumed, so the practical impact is a potential page fault rather than data leakage.