---
id: "CVE-2026-98803"
kind: "vulnerability"
aliases: ["CVE-2026-98803"]
title: "Linux kernel: stmmac Ethernet driver DMA overflow causes IOMMU faults"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["arm", "embedded", "iommu", "linux-kernel", "runtime", "stmmac"]
not_affected_if: ["no-stmmac-hardware"]
published_at: "2026-10-18T16:17:34+00:00"
first_seen_at: "2026-10-23T21:57:16+00:00"
updated_at: "2026-10-25T05:15:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98803", "first_seen_at": "2026-10-23T21:57:16+00:00"}]
---

# Linux kernel: stmmac Ethernet driver DMA overflow causes IOMMU faults

In the Linux kernel's stmmac Ethernet driver, frames larger than the RX buffer were written into an unmapped secondary buffer, causing IOMMU translation faults. The kernel fix enables proper scatter-gather RX buffer allocation on GMAC4 and XGMAC cores.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the host kernel includes the stmmac scatter-gather fix (unknown from the sources; compare the running kernel version against the fixed kernel in the upstream commit)
- Look for the stmmac driver on the machine with `lsmod | grep stmmac` or `dmesg | grep stmmac` (unknown whether the sources name a specific command)
- Look for arm-smmu context fault messages in `dmesg` (unknown whether the sources list a specific string beyond the sample log)

## Fix

- Update the Linux kernel to a release that includes the upstream stmmac rx Scatter-Gather fix (the fixed version is unknown from the sources)
- Until patched, the sources do not name a workaround (unknown)

## Timeline

- 2026-10-23T21:57:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98803

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

net: stmmac: fix rx Scatter-Gather support

When a received frame is larger than dma_buf_sz, the DMA scatters it
across multiple RX descriptors (rx Scatter-Gather). The secondary RX
buffer (sec_page) was only allocated and programmed when split-header
(SPH) was active, so for regular frames buffer2 was neither allocated
nor backed by a valid mapping. As soon as an incoming frame overflowed
buffer1, the DMA wrote the overflow into the unmapped secondary-buffer
address, triggering an SMMU translation fault on IOMMU-based platforms:

arm-smmu 15000000.iommu: Unhandled context fault: fsr=0x402, iova=0x00000000, fsynr=0x7f0011, cbfrsynra=0x1c90, cb=11
arm-smmu 15000000.iommu: FSR    = 00000402 [Format=2 TF], SID=0x1c90
arm-smmu 15000000.iommu: FSYNR0 = 007f0011 [S1CBNDX=127 WNR PLVL=1]

Enable scatter-gather for non-SPH frames on cores that can program an
independent secondary RX buffer (GMAC4/XGMAC): allocate and mark buffer2
as valid in stmmac_init_rx_buffers() and stmmac_rx_refill(), and account
for it in the buffer length computation. Legacy cores have no set_sec_addr
op, so they keep buffer2 disabled.

Since buffer2 is handed to the DMA at page offset 0, the page pool sync
window is widened to cover both buffers in every mode: offset is set to 0
and max_len to dma_buf_sz + stmmac_rx_offset().

The FCS can straddle the buffer1/buffer2 boundary and a descriptor
boundary, so it is now stripped from the tail of the assembled frame with
pskb_trim() instead of from a single buffer, avoiding an unsigned underflow
for frames that overflow a buffer by 1..3 bytes. For single-buffer frames
the XDP program must not see the FCS, so it is removed from the XDP buffer
before the program runs.

Native XDP currently only supports single-buffer (linear) frames. An
oversized frame accepted by the MAC (jumbo enabled) is received via
buffer2; the XDP program only sees buffer1, so on a TX/REDIRECT verdict
the frame is forwarded truncated. XDP multi-buffer support to handle
this case is planned as a follow-up.

AF_XDP zero-copy RX is not covered by this change: a ZC queue still
programs buffer2 at DMA address 0 (and XGMAC has no buffer2-valid bit),
so an oversized frame overflowing buffer1 can still trigger the same
SMMU translation fault. Handling is planned as a follow-up.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_