{"id":"CVE-2026-98803","kind":"vulnerability","aliases":["CVE-2026-98803"],"related":[],"title":"Linux kernel: stmmac Ethernet driver DMA overflow causes IOMMU faults","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: fix rx Scatter-Gather support\n\nWhen a received frame is larger than dma_buf_sz, the DMA scatters it\nacross multiple RX descriptors (rx Scatter-Gather). The secondary RX\nbuffer (sec_page) was only allocated and programmed when split-header\n(SPH) was active, so for regular frames buffer2 was neither allocated\nnor backed by a valid mapping. As soon as an incoming frame overflowed\nbuffer1, the DMA wrote the overflow into the unmapped secondary-buffer\naddress, triggering an SMMU translation fault on IOMMU-based platforms:\n\narm-smmu 15000000.iommu: Unhandled context fault: fsr=0x402, iova=0x00000000, fsynr=0x7f0011, cbfrsynra=0x1c90, cb=11\narm-smmu 15000000.iommu: FSR    = 00000402 [Format=2 TF], SID=0x1c90\narm-smmu 15000000.iommu: FSYNR0 = 007f0011 [S1CBNDX=127 WNR PLVL=1]\n\nEnable scatter-gather for non-SPH frames on cores that can program an\nindependent secondary RX buffer (GMAC4/XGMAC): allocate and mark buffer2\nas valid in stmmac_init_rx_buffers() and stmmac_rx_refill(), and account\nfor it in the buffer length computation. Legacy cores have no set_sec_addr\nop, so they keep buffer2 disabled.\n\nSince buffer2 is handed to the DMA at page offset 0, the page pool sync\nwindow is widened to cover both buffers in every mode: offset is set to 0\nand max_len to dma_buf_sz + stmmac_rx_offset().\n\nThe FCS can straddle the buffer1/buffer2 boundary and a descriptor\nboundary, so it is now stripped from the tail of the assembled frame with\npskb_trim() instead of from a single buffer, avoiding an unsigned underflow\nfor frames that overflow a buffer by 1..3 bytes. For single-buffer frames\nthe XDP program must not see the FCS, so it is removed from the XDP buffer\nbefore the program runs.\n\nNative XDP currently only supports single-buffer (linear) frames. An\noversized frame accepted by the MAC (jumbo enabled) is received via\nbuffer2; the XDP program only sees buffer1, so on a TX/REDIRECT verdict\nthe frame is forwarded truncated. XDP multi-buffer support to handle\nthis case is planned as a follow-up.\n\nAF_XDP zero-copy RX is not covered by this change: a ZC queue still\nprograms buffer2 at DMA address 0 (and XGMAC has no buffer2-valid bit),\nso an oversized frame overflowing buffer1 can still trigger the same\nSMMU translation fault. Handling is planned as a follow-up.","summary":"In the Linux kernel's stmmac Ethernet driver, frames larger than the RX buffer were written into an unmapped secondary buffer, causing IOMMU translation faults. The kernel fix enables proper scatter-gather RX buffer allocation on GMAC4 and XGMAC cores.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["arm","embedded","iommu","linux-kernel","runtime","stmmac"],"not_affected_if":["no-stmmac-hardware"],"how_to_check":"- Check whether the host kernel includes the stmmac scatter-gather fix (unknown from the sources; compare the running kernel version against the fixed kernel in the upstream commit)\n- Look for the stmmac driver on the machine with `lsmod | grep stmmac` or `dmesg | grep stmmac` (unknown whether the sources name a specific command)\n- Look for arm-smmu context fault messages in `dmesg` (unknown whether the sources list a specific string beyond the sample log)","fix":"- Update the Linux kernel to a release that includes the upstream stmmac rx Scatter-Gather fix (the fixed version is unknown from the sources)\n- Until patched, the sources do not name a workaround (unknown)","status":"open","published_at":"2026-10-18T16:17:34+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:15:04+00:00","updated_at":"2026-10-25T05:15:04+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:15:04Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream stmmac rx Scatter-Gather fix (the fixed version is unknown from the sources)\n- Until patched, the sources do not name a workaround (unknown)","reach":"network","title":"Linux kernel: stmmac Ethernet driver DMA overflow causes IOMMU faults","impact":"medium","summary":"In the Linux kernel's stmmac Ethernet driver, frames larger than the RX buffer were written into an unmapped secondary buffer, causing IOMMU translation faults. The kernel fix enables proper scatter-gather RX buffer allocation on GMAC4 and XGMAC cores.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","arm","stmmac","iommu","embedded"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; sources do not state the attacker impact beyond translation faults","analyst_note":"Find the fixed kernel version and upstream commit from the NVD entry and kernel.org stable advisories, and confirm the attacker impact and whether remote frames trigger it.","how_to_check":"- Check whether the host kernel includes the stmmac scatter-gather fix (unknown from the sources; compare the running kernel version against the fixed kernel in the upstream commit)\n- Look for the stmmac driver on the machine with `lsmod | grep stmmac` or `dmesg | grep stmmac` (unknown whether the sources name a specific command)\n- Look for arm-smmu context fault messages in `dmesg` (unknown whether the sources list a specific string beyond the sample log)","needs_analyst":true,"not_affected_if":["no-stmmac-hardware"],"who_is_affected":"Systems running the Linux kernel with the stmmac Ethernet driver on GMAC4 or XGMAC cores, especially IOMMU-based ARM platforms, where oversized frames can overflow the first RX buffer. Systems without stmmac hardware or without an IOMMU are less likely to show the reported fault, though the sources do not state this explicitly. AF_XDP zero-copy RX remains exposed per the description.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000813,"input_tokens":4210,"output_tokens":785,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98803':13A,16A '0':274C,293C,451C '00000402':190C '007f0011':201C '0x00000000':178C '0x1c90':182C,195C '0x402':176C '0x7f0011':180C '1':206C,347C '11':184C '127':203C '15000000.iommu':171C,188C,199C '2':192C '3':348C 'accept':388C 'account':243C 'across':98C 'activ':123C 'addr':257C 'address':157C,450C 'af':430C 'alloc':60B,114C,131C,227C 'arm':17B,169C,186C,197C 'arm-smmu':168C,185C,196C 'assembl':325C 'avoid':336C 'back':133C 'base':166C 'bit':459C 'boundari':310C,314C 'buf':92C,299C 'buffer':38B,45B,59B,109C,156C,225C,237C,248C,285C,335C,345C,353C,370C,382C,417C 'buffer1':145C,403C,465C 'buffer1/buffer2':309C 'buffer2':128C,230C,262C,265C,397C,447C,457C 'buffer2-valid':456C 'byte':349C 'case':422C 'caus':8A,46B 'cb':183C 'cbfrsynra':181C 'chang':441C 'comput':250C 'context':173C 'copi':434C 'core':65B,217C,252C 'cover':283C,438C 'current':377C 'cve':11A,14A 'descriptor':101C,313C 'disabl':263C 'dma':6A,91C,95C,147C,270C,298C,449C 'driver':5A,32B 'embed':18B 'enabl':53B,207C,393C 'ethernet':4A,31B 'everi':287C 'fault':10A,49B,162C,174C,473C 'fcs':305C,362C 'fix':52B,78C 'follow':71C,428C,480C 'follow-up':427C,479C 'format':191C 'forward':412C 'frame':33B,87C,127C,143C,215C,326C,341C,354C,384C,387C,410C,463C 'fsr':175C,189C 'fsynr':179C 'fsynr0':200C 'gather':57B,82C,105C,210C 'gmac4':62B 'gmac4/xgmac':226C 'hand':267C 'handl':420C,474C 'header':120C 'incom':142C 'independ':222C 'init':235C 'instead':330C 'iommu':9A,19B,47B,165C 'iommu-bas':164C 'iova':177C 'jumbo':392C 'keep':261C 'kernel':2A,22B,28B,51B,69C 'larger':34B,89C 'legaci':251C 'len':296C 'length':249C 'linear':383C 'linux':1A,21B,27B,68C 'linux-kernel':20B 'mac':391C 'map':137C 'mark':229C 'max':295C 'mode':288C 'multi':416C 'multi-buff':415C 'multipl':99C 'must':358C 'nativ':375C 'neither':130C 'net':76C 'non':213C 'non-sph':212C 'offset':273C,289C,303C 'op':258C 'overflow':7A,144C,150C,343C,464C 'overs':386C,462C 'page':111C,272C,276C 'plan':424C,476C 'platform':167C 'plvl':205C 'pool':277C 'program':116C,220C,357C,373C,400C,446C 'proper':54B 'pskb':328C 'queue':444C 'receiv':86C,395C 'refil':241C 'regular':126C 'remov':366C 'resolv':75C 'run':374C 'runtim':23B 'rx':37B,58B,79C,100C,102C,108C,224C,236C,240C,302C,435C 's1cbndx':202C 'scatter':56B,81C,96C,104C,209C 'scatter-gath':55B,80C,103C,208C 'sec':110C,256C 'secondari':44B,107C,155C,223C 'secondary-buff':154C 'see':360C,402C 'set':255C,291C 'sid':194C 'sinc':264C 'singl':334C,352C,381C 'single-buff':351C,380C 'smmu':160C,170C,187C,198C,471C 'soon':139C 'sph':121C,214C 'split':119C 'split-head':118C 'still':445C,467C 'stmmac':3A,24B,30B,77C,234C,239C,301C 'straddl':307C 'strip':319C 'support':83C,379C,418C 'sync':278C 'sz':93C,300C 'tail':322C 'tf':193C 'translat':48B,161C,472C 'trigger':158C,468C 'trim':329C 'truncat':413C 'tx/redirect':407C 'underflow':339C 'unhandl':172C 'unmap':43B,153C 'unsign':338C 'valid':136C,232C,458C 'verdict':408C 'via':396C 'vulner':72C 'widen':281C 'window':279C 'wnr':204C 'written':40B 'wrote':148C 'xdp':356C,369C,376C,399C,414C,431C 'xgmac':64B,453C 'zc':443C 'zero':433C 'zero-copi':432C","nicknames":[],"mitigations":[],"who_affected":"Systems running the Linux kernel with the stmmac Ethernet driver on GMAC4 or XGMAC cores, especially IOMMU-based ARM platforms, where oversized frames can overflow the first RX buffer. Systems without stmmac hardware or without an IOMMU are less likely to show the reported fault, though the sources do not state this explicitly. AF_XDP zero-copy RX remains exposed per the description.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:34+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98803","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98803","severity":null,"published_at":"2026-10-18T16:17:34+00:00","modified_at":"2026-10-19T10:19:44+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}