Linux Kernel EUVD-2026-25551

The vulnerability resides in drivers/net/ethernet/altera/altera_tse.c within the Linux kernel, which implements the Altera Triple Speed Ethernet MAC IP core - a hardware block found on Altera/Intel FPGAs and embedded SoCs. The affected function tse_start_xmit() maps kernel socket buffers (skbs) to DMA addresses for hardware-accelerated packet transmission using dma_map_single(). CWE-401 (Missing Release of Memory after Effective Lifetime) applies precisely: when dma_map_single() returns a mapping error, the function returns NETDEV_TX_OK without calling dev_kfree_skb_any(). NETDEV_TX_OK signals to the network stack that the packet was fully consumed, causing the stack to drop its reference - but the driver never frees the buffer, permanently leaking kernel memory. The fix, backported across multiple stable branches per upstream commits at git.kernel.org/stable, inserts the missing dev_kfree_skb_any() call before the early return. CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covers the affected component.