{"id":"CVE-2026-63857","state":"PUBLISHED","title":"net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: airoha: Do not read uninitialized fragment address in airoha_dev_xmit()\n\nThe transmit loop in airoha_dev_xmit() reads fragment address and length\nduring its final iteration, when the loop index equals\nskb_shinfo(skb)->nr_frags, at which point the fragment data is\nuninitialized. While these values are never consumed, the read itself is\nunsafe and may trigger a page fault. Fix this by avoiding the fragment\nread on the last iteration.\nAdditionally, move the skb pointer from the first to the last used packet\ndescriptor, so that airoha_qdma_tx_napi_poll() defers freeing the skb\nuntil the final descriptor is processed.","publishedAt":"2026-07-19T14:04:46.339Z","updatedAt":"2026-10-21T12:42:41.508Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"23020f04932701d5c8363e60756f12b43b8ed752","status":"affected","lessThan":"dba5f4959653e4c212beb746594952e8645d1115","versionType":"git"},{"version":"23020f04932701d5c8363e60756f12b43b8ed752","status":"affected","lessThan":"f670fa4b19ceddc6d215dda4997888ccba9bbc61","versionType":"git"},{"version":"23020f04932701d5c8363e60756f12b43b8ed752","status":"affected","lessThan":"d78c8ab7bd84952e053d0c622b7fc1b4ad8a19a3","versionType":"git"},{"version":"23020f04932701d5c8363e60756f12b43b8ed752","status":"affected","lessThan":"bde34e84edc8b5571fbde7e941e175a4293ee1eb","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/airoha/airoha_eth.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.11","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.11","versionType":"semver"},{"version":"6.12.114","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.33","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.0.10","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/airoha/airoha_eth.c"]}],"references":["https://git.kernel.org/stable/c/dba5f4959653e4c212beb746594952e8645d1115","https://git.kernel.org/stable/c/f670fa4b19ceddc6d215dda4997888ccba9bbc61","https://git.kernel.org/stable/c/d78c8ab7bd84952e053d0c622b7fc1b4ad8a19a3","https://git.kernel.org/stable/c/bde34e84edc8b5571fbde7e941e175a4293ee1eb"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:41.951Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/63xxx/CVE-2026-63857.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-63857","state":"PUBLISHED","datePublished":"2026-07-19T14:04:46.339Z","dateUpdated":"2026-10-21T12:42:41.508Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-07-19T07:54:57.016Z"},"containers":{"cna":{"title":"net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: airoha: Do not read uninitialized fragment address in airoha_dev_xmit()\n\nThe transmit loop in airoha_dev_xmit() reads fragment address and length\nduring its final iteration, when the loop index equals\nskb_shinfo(skb)->nr_frags, at which point the fragment data is\nuninitialized. While these values are never consumed, the read itself is\nunsafe and may trigger a page fault. Fix this by avoiding the fragment\nread on the last iteration.\nAdditionally, move the skb pointer from the first to the last used packet\ndescriptor, so that airoha_qdma_tx_napi_poll() defers freeing the skb\nuntil the final descriptor is processed."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"23020f04932701d5c8363e60756f12b43b8ed752","status":"affected","lessThan":"dba5f4959653e4c212beb746594952e8645d1115","versionType":"git"},{"version":"23020f04932701d5c8363e60756f12b43b8ed752","status":"affected","lessThan":"f670fa4b19ceddc6d215dda4997888ccba9bbc61","versionType":"git"},{"version":"23020f04932701d5c8363e60756f12b43b8ed752","status":"affected","lessThan":"d78c8ab7bd84952e053d0c622b7fc1b4ad8a19a3","versionType":"git"},{"version":"23020f04932701d5c8363e60756f12b43b8ed752","status":"affected","lessThan":"bde34e84edc8b5571fbde7e941e175a4293ee1eb","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/airoha/airoha_eth.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.11","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.11","versionType":"semver"},{"version":"6.12.114","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.33","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.0.10","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/airoha/airoha_eth.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/dba5f4959653e4c212beb746594952e8645d1115"},{"url":"https://git.kernel.org/stable/c/f670fa4b19ceddc6d215dda4997888ccba9bbc61"},{"url":"https://git.kernel.org/stable/c/d78c8ab7bd84952e053d0c622b7fc1b4ad8a19a3"},{"url":"https://git.kernel.org/stable/c/bde34e84edc8b5571fbde7e941e175a4293ee1eb"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in netdev TX (`ndo_start_xmit`) on Airoha EN7581 WAN/LAN interfaces; a remote attacker can trigger transmission by sending packets that cause responses, NAT forwarding, or bridged/routed egress without local access.\nAC:L - Any outbound skb traversing this driver hits the defective loop deterministically; an attacker can reliably provoke multi-fragment transmits (scatter/gather is enabled) to also trigger the premature-skb-free UAF without depending on uncontrollable timing or layout.\nPR:N - Exploitation requires only the ability to send network traffic to or through the device's registered netdevs; no local account, capability, or authentication is needed on internet-facing router/CPE deployments.\nUI:N - No victim interaction is required beyond normal always-on network traffic handled by the kernel stack.\nS:U - Impact is confined to kernel memory and the host running the Airoha driver; it does not cross a VM/hypervisor or IOMMU security boundary.\nC:H - The final loop iteration performs an out-of-bounds read of uninitialized `skb_frag_t` contents that may contain stale kernel heap data, and the companion skb lifetime bug creates a use-after-free that can be leveraged for arbitrary kernel memory disclosure.\nI:H - Premature freeing of the skb while later TX descriptors still DMA mapped fragment memory is a heap use-after-free that can be exploited for arbitrary kernel writes or code execution, not merely a discarded read.\nA:H - Reading garbage fragment metadata can cause a kernel page fault/oops, and the skb use-after-free can crash or panic the system during subsequent DMA completion or skb reuse."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-21T12:42:41.508Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"6.12.114"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"6.18.33"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"7.0.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"7.1"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}