Linux Kernel EUVD-2026-86807

Requires the stmmac (STMicroelectronics DWMAC/DWXGMAC) Ethernet driver in use with TCP Segmentation Offload / GSO enabled, and a local sender able to submit a highly-fragmented large TSO skb while the TX descriptor ring is nearly full - the corruption only occurs when the underestimated free-descriptor count lets an oversized allocation slip through. Limiting factors: the driver is specific to STMicro MAC hardware (largely ARM/embedded SoCs, not typical x86 servers); the trigger is the host's own transmit path (local, not a remotely chosen packet); and it is data-/timing-dependent on both skb fragmentation and ring occupancy (hence AC:H), so it is not reliably reproducible on demand.

This is a Linux kernel bug in the stmmac (STMicroelectronics DWMAC/DWXGMAC) Ethernet driver's TSO transmit path, where the free-TX-descriptor availability check undercounts the descriptors that stmmac_tso_allocator() actually consumes, allowing a highly-fragmented TSO skb to pass the check with too few free slots and write past the available descriptors - overwriting descriptors still owned by the DMA engine and corrupting the TX ring. The supplied CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/C:L/I:L/A:H = 7.0) is internally inconsistent with the mechanism: the trigger is the host's own transmit path, so a local process generating fragmented TSO/GSO traffic drives the bug rather than a remote unauthenticated packet - AV:N and PR:N are questionable and likely overstate reach (a remote peer does not choose how the local stack fragments an outgoing TSO skb). AC:H is well-justified: it requires a specifically fragmented skb layout and a full descriptor ring, a data-dependent corner case, not a deterministic path. The realistic impact is availability (ring corruption → crash/hang), so the C:L/I:L allocation and the 'Information Disclosure' tag are not supported by the description, which mentions no read/leak primitive. EPSS, KEV, and POC signals are all absent: no evidence of active exploitation or public exploit code, and this is a stability/DoS-class fix rather than a targeted attack primitive. Net: a legitimate memory-corruption bug worth patching on affected embedded/ARM deployments, but real-world priority is low-to-moderate - it is a local, high-complexity DoS, not the network-reachable 7.0 the raw score implies.

On a device using the stmmac Ethernet driver with TSO/segmentation offload enabled, a local process transmits a carefully-constructed, highly-fragmented large TSO buffer while the TX descriptor ring is nearly full. The flawed availability check underestimates the descriptors needed, so the allocator writes past the free slots, overwrites descriptors still owned by the DMA engine, and corrupts the TX ring - hanging or crashing the networking path. No public exploit code is identified, and the data-dependent, high-complexity nature makes reliable triggering difficult.