Linux Kernel EUVD-2026-86962

Exploitation requires the target device to use the stmmac (Synopsys DesignWare MAC) network driver with TSO (TCP Segmentation Offload) active, and requires a DMA mapping of an skb fragment in stmmac_tso_xmit() to actually fail - a condition that normally arises only under memory pressure or IOMMU/DMA address-space exhaustion, not on demand. The attacker needs local access with the ability to send network traffic (PR:L, AV:L); there is no remote vector and no user interaction. Strong limiting factors: hardware-specific (only stmmac-based NICs, typical of embedded/ARM SoCs, not Intel/Realtek desktop/server NICs), the leak is incremental rather than a single-shot crash, and reliably forcing DMA mapping failures is difficult, substantially reducing realistic exploitability.

This is a genuine but low-priority defensive fix, not an urgent threat. All signals point the same direction: the CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5 MEDIUM) describes a local, low-privilege availability-only issue with no confidentiality or integrity impact, consistent with CWE-401 (missing release of memory). EPSS reinforces this with a very low 0.15% exploitation probability (4th percentile), the CVE is NOT on the CISA KEV list, and no public exploit code is referenced. There is a notable data conflict: the input Tags label this 'Information Disclosure', yet the CVSS vector sets C:N and the root cause is a DMA-mapping/memory leak whose only impact is availability (A:H) - the 'Information Disclosure' tag appears mislabeled and should be disregarded for prioritization. Practically, the leak only accumulates when DMA mapping of an skb fragment fails inside the TSO transmit path, which normally occurs only under memory/IOMMU pressure, so real-world exploitability is marginal. Verdict: routine kernel hardening - patch via normal stable-kernel update cycles rather than emergency response.

A local user on a device using the stmmac (Synopsys DesignWare) Ethernet driver generates heavy TCP traffic over the TSO transmit path while the system is under memory or IOMMU pressure, causing skb-fragment DMA mappings to fail. Each failed frame leaks the DMA mappings already allocated for the linear part and prior fragments; repeated failures gradually exhaust DMA address space and degrade or hang networking. No public exploit code is identified, and triggering it reliably depends on inducing DMA mapping failures.