{"id":"CVE-2026-98592","kind":"vulnerability","aliases":["CVE-2026-98592"],"related":[],"title":"Linux kernel: SpacemiT Ethernet driver can DMA from freed buffers","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: spacemit: clear TX descriptor on fragment mapping failure\n\nemac_tx_mem_map() writes TX_DESC_0_OWN into the ring descriptor for\nevery slot beyond old_head as soon as that slot's memset()'d local\ncopy is committed with \"*tx_desc_addr = tx_desc\", i.e. before the\nbuffers for that slot have necessarily all been mapped successfully.\nIf emac_tx_map_frag() then fails on a later fragment, the err_free_skb\npath calls emac_free_tx_buf() to unmap and drop the skb, but leaves\nthe already-written descriptor memory untouched, and tx_ring->head is\nnever advanced past old_head (the \"tx_ring->head = head\" store is\nskipped by the goto).\n\nSo a slot between old_head and the rolled-back head can be left with\nTX_DESC_0_OWN set and buffer_addr_{1,2} pointing at DMA mappings that\nemac_free_tx_buf() just tore down, while software considers that slot\nfree again. The next successful emac_tx_mem_map() call only rebuilds\nold_head itself; if the DMA engine auto-advances into the following\ndescriptor once it finishes old_head's packet, it will fetch that\nstale, already-unmapped address.\n\nemac_tx_clean_desc() already treats emac_free_tx_buf() and clearing\nthe descriptor as a pair when reclaiming completed descriptors; do\nthe same in the mapping failure path.","summary":"In the SpacemiT Ethernet driver, a TX descriptor can stay marked as owned by hardware after a fragment mapping failure, pointing at DMA mappings that were already torn down. The DMA engine may then fetch that stale, unmapped address on a later transmit.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","linux-kernel","other","spacemit"],"not_affected_if":["no-spacemit-hardware"],"how_to_check":"- unknown","fix":"- Install a Linux kernel build that includes the upstream commit 'net: spacemit: clear TX descriptor on fragment mapping failure'.\n- Check the kernel version with `uname -r` and compare it against the distribution's security advisory for this CVE.","status":"open","published_at":"2026-10-18T16:17:11+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:21:41+00:00","updated_at":"2026-10-25T05:21:41+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-25T05:21:41Z","model":"claude-haiku-5-5","output":{"fix":"- Install a Linux kernel build that includes the upstream commit 'net: spacemit: clear TX descriptor on fragment mapping failure'.\n- Check the kernel version with `uname -r` and compare it against the distribution's security advisory for this CVE.","reach":"unknown","title":"Linux kernel: SpacemiT Ethernet driver can DMA from freed buffers","impact":"medium","summary":"In the SpacemiT Ethernet driver, a TX descriptor can stay marked as owned by hardware after a fragment mapping failure, pointing at DMA mappings that were already torn down. The DMA engine may then fetch that stale, unmapped address on a later transmit.","category":"other","nicknames":[],"who_cares":["linux-kernel","spacemit","embedded"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; stale DMA reads of freed buffers, memory corruption possible","analyst_note":"Check the NVD entry and the upstream kernel commit for the fixed kernel versions and the exploitability of the DMA stale-read path.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-spacemit-hardware"],"who_is_affected":"Systems running a Linux kernel with the SpacemiT Ethernet driver (net: spacemit), which is used on SpacemiT-based boards. The sources do not say which boards or configurations are common, so unknown. Hosts using other network hardware are unlikely to be affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000651,"input_tokens":3722,"output_tokens":558,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98592':13A,16A '0':92C,210C '1':216C '2':217C 'addr':119C,215C 'address':61B,276C 'advanc':177C,256C 'alreadi':49B,166C,274C,281C 'already-unmap':273C 'already-written':165C 'auto':255C 'auto-adv':254C 'back':202C 'beyond':101C 'buf':155C,226C,286C 'buffer':10A,125C,214C 'call':151C,244C 'clean':279C 'clear':78C,288C 'commit':115C 'complet':296C 'consid':232C 'copi':113C 'cve':11A,14A 'd':111C 'desc':91C,118C,121C,209C,280C 'descriptor':30B,80C,97C,168C,260C,290C,297C 'dma':7A,45B,53B,220C,252C 'driver':5A,27B 'drop':159C 'emac':85C,136C,152C,223C,240C,277C,283C 'embed':17B 'engin':54B,253C 'err':147C 'ethernet':4A,26B 'everi':99C 'fail':141C 'failur':42B,84C,304C 'fetch':57B,270C 'finish':263C 'follow':71C,259C 'frag':139C 'fragment':40B,82C,145C 'free':148C,153C,224C,235C,284C 'freed':9A 'goto':191C 'hardwar':37B 'head':103C,174C,180C,184C,185C,197C,203C,248C,265C 'i.e':122C 'kernel':2A,20B,69C 'later':64B,144C 'leav':163C 'left':206C 'linux':1A,19B,68C 'linux-kernel':18B 'local':112C 'map':41B,46B,83C,88C,133C,138C,221C,243C,303C 'mark':33B 'may':55B 'mem':87C,242C 'memori':169C 'memset':110C 'necessarili':130C 'net':76C 'never':176C 'next':238C 'old':102C,179C,196C,247C,264C 'own':35B 'packet':267C 'pair':293C 'past':178C 'path':150C,305C 'point':43B,218C 'rebuild':246C 'reclaim':295C 'resolv':75C 'ring':96C,173C,183C 'roll':201C 'rolled-back':200C 'set':212C 'skb':149C,161C 'skip':188C 'slot':100C,108C,128C,194C,234C 'softwar':231C 'soon':105C 'spacemit':3A,22B,25B,77C 'stale':59B,272C 'stay':32B 'store':186C 'success':134C,239C 'tore':228C 'torn':50B 'transmit':65B 'treat':282C 'tx':29B,79C,86C,90C,117C,120C,137C,154C,172C,182C,208C,225C,241C,278C,285C 'unmap':60B,157C,275C 'untouch':170C 'vulner':72C 'write':89C 'written':167C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the SpacemiT Ethernet driver (net: spacemit), which is used on SpacemiT-based boards. The sources do not say which boards or configurations are common, so unknown. Hosts using other network hardware are unlikely to be affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:11+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98592","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98592","severity":null,"published_at":"2026-10-18T16:17:11+00:00","modified_at":"2026-10-19T10:19:20+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}