{"id":"CVE-2026-98571","kind":"vulnerability","aliases":["CVE-2026-98571"],"related":[],"title":"Linux kernel stmmac driver reuses a recycled RX page after failure","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: clear stale buf->page after recycling on skb build failure\n\nIn stmmac_rx(), when napi_build_skb() fails the descriptor page is\nrecycled back to the page pool with page_pool_recycle_direct(), but\nbuf->page is left pointing at the recycled page, unlike every other\nconsumption site in the function which clears the pointer after handing\nthe page away.\n\nWith the stale pointer stmmac_rx_refill() skips the replacement\nallocation and programs the already-recycled page back into the RX\ndescriptor.\n\nClear buf->page on the napi_build_skb() failure path to keep the buffer\nlifecycle consistent with the other consumption sites.","summary":"When the stmmac Ethernet driver fails to build an sk_buff on receive, it returns the page to the page pool but keeps a pointer to it, so the refill step can hand the same page back to the hardware. The sources do not describe a confirmed exploit or what an attacker can read or write through this.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","linux-kernel","package","stmmac"],"not_affected_if":[],"how_to_check":"- unknown","fix":"- Update the Linux kernel to a release that includes the upstream commit clearing buf->page in stmmac_rx() (version not given in the sources).","status":"open","published_at":"2026-10-18T16:17:09+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:23:13+00:00","updated_at":"2026-10-25T05:23:13+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-25T05:23:13Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit clearing buf->page in stmmac_rx() (version not given in the sources).","reach":"network","title":"Linux kernel stmmac driver reuses a recycled RX page after failure","impact":"medium","summary":"When the stmmac Ethernet driver fails to build an sk_buff on receive, it returns the page to the page pool but keeps a pointer to it, so the refill step can hand the same page back to the hardware. The sources do not describe a confirmed exploit or what an attacker can read or write through this.","category":"package","nicknames":[],"who_cares":["linux-kernel","stmmac","embedded"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown: possible reuse of a recycled DMA page by the NIC","analyst_note":"Check the upstream kernel commit and the NVD entry for affected version ranges and the exploitability of the napi_build_skb failure path.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Systems running a Linux kernel with the stmmac driver, typically embedded boards or servers with Synopsys DesignWare Ethernet MACs. The sources do not say which kernel versions are affected or how an attacker would trigger the failure path. unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000592,"input_tokens":3454,"output_tokens":494,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98571':14A,17A 'alloc':162C 'alreadi':167C 'already-recycl':166C 'attack':75B 'away':151C 'back':60B,115C,170C 'buf':94C,126C,176C 'buff':34B 'buffer':188C 'build':31B,100C,107C,181C 'clear':92C,144C,175C 'confirm':70B 'consist':190C 'consumpt':138C,194C 'cve':12A,15A 'describ':68B 'descriptor':111C,174C 'direct':124C 'driver':4A,28B 'embed':18B 'ethernet':27B 'everi':136C 'exploit':71B 'fail':29B,109C 'failur':11A,101C,183C 'follow':85C 'function':142C 'hand':56B,148C 'hardwar':63B 'keep':46B,186C 'kernel':2A,21B,83C 'left':129C 'lifecycl':189C 'linux':1A,20B,82C 'linux-kernel':19B 'napi':106C,180C 'net':90C 'packag':22B 'page':9A,40B,43B,59B,95C,112C,118C,121C,127C,134C,150C,169C,177C 'path':184C 'point':130C 'pointer':48B,146C,155C 'pool':44B,119C,122C 'program':164C 'read':77B 'receiv':36B 'recycl':7A,97C,114C,123C,133C,168C 'refil':53B,158C 'replac':161C 'resolv':89C 'return':38B 'reus':5A 'rx':8A,104C,157C,173C 'site':139C,195C 'sk':33B 'skb':99C,108C,182C 'skip':159C 'sourc':65B 'stale':93C,154C 'step':54B 'stmmac':3A,23B,26B,91C,103C,156C 'unlik':135C 'vulner':86C 'write':79B","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the stmmac driver, typically embedded boards or servers with Synopsys DesignWare Ethernet MACs. The sources do not say which kernel versions are affected or how an attacker would trigger the failure path. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:09+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98571","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98571","severity":null,"published_at":"2026-10-18T16:17:09+00:00","modified_at":"2026-10-19T10:19:15+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}