Live › vulnerability › CVE-2026-98571
Go to dashboardWhen the stmmac Ethernet driver fails to build an sk_buff on receive, it returns the page to the page pool but keeps a pointer to it, so the refill step can hand the same page back to the hardware. The sources do not describe a confirmed exploit or what an attacker can read or write through this.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with the stmmac driver, typically embedded boards or servers with Synopsys DesignWare Ethernet MACs. The sources do not say which kernel versions are affected or how an attacker would trigger the failure path. unknown
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
net: stmmac: clear stale buf->page after recycling on skb build failure
In stmmac_rx(), when napi_build_skb() fails the descriptor page is recycled back to the page pool with page_pool_recycle_direct(), but buf->page is left pointing at the recycled page, unlike every other consumption site in the function which clears the pointer after handing the page away.
With the stale pointer stmmac_rx_refill() skips the replacement allocation and programs the already-recycled page back into the RX descriptor.
Clear buf->page on the napi_build_skb() failure path to keep the buffer lifecycle consistent with the other consumption sites.
This page as .md · .json · in your agent: get_signal("CVE-2026-98571")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.