Description
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: clear stale buf->page after recycling on skb build failure In stmmac_rx(), when napi_build_skb() fails the descriptor page is recycled back to the page pool with page_pool_recycle_direct(), but buf->page is left pointing at the recycled page, unlike every other consumption site in the function which clears the pointer after handing the page away. With the stale pointer stmmac_rx_refill() skips the replacement allocation and programs the already-recycled page back into the RX descriptor. Clear buf->page on the napi_build_skb() failure path to keep the buffer lifecycle consistent with the other consumption sites.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
df542f669307918f054a17878ff6dd1ddbb2fe18 to < 501baaeca7d128fa0a2f6953cf5873c5b0d7cf89affecteddf542f669307918f054a17878ff6dd1ddbb2fe18 to < 298673397ea3f6f5811b84f0d9f71eac71dda2e3affecteddf542f669307918f054a17878ff6dd1ddbb2fe18 to < 0a7822e34a0bfde31b194ac3da3253e5032b44ccaffected
Linux Linux
Default version status: affected
6.14affected0 to < 6.14unaffected6.18.55 to ≤ 6.18.*unaffected7.2.9 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected