Linux Kernel EUVD-2026-39308

The flaw lives in the mvpp2 driver for Marvell PPv2 Ethernet controllers (Armada 7K/8K and similar SoCs). mvpp2 configures the hardware RX queue to write incoming data at dma_addr + MVPP2_SKB_HEADROOM, but the CPU-side DMA cache sync incorrectly began at dma_addr and covered only rx_bytes + MVPP2_MH_SIZE. On architectures with non-coherent DMA (common on ARM platforms where mvpp2 is deployed), the CPU and device do not share a coherent view of memory, so an incorrectly sized dma_sync leaves cache lines covering the packet tail unsynchronized; the CPU then reads previously cached (stale) memory instead of the freshly DMA'd frame data. The fix switches to dma_sync_single_range_for_cpu() using MVPP2_SKB_HEADROOM as the range offset so the sync window matches the Marvell header plus the actual packet bytes written by hardware. No CWE was assigned in the input, but the root-cause class is improper synchronization of a DMA buffer leading to use of stale/uninitialized cache contents (an information-exposure / incorrect-buffer-handling issue).