CVE-2026-98571 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
net: stmmac: clear stale buf->page after recycling on skb build failure
In stmmac_rx(), when napi_build_skb() fails the descriptor page is recycled back to the page pool with page_pool_recycle_direct(), but buf->page is left pointing at the recycled page, unlike every other consumption site in the function which clears the pointer after handing the page away.
With the stale pointer stmmac_rx_refill() skips the replacement allocation and programs the already-recycled page back into the RX descriptor.
Clear buf->page on the napi_build_skb() failure path to keep the buffer lifecycle consistent with the other consumption sites.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/18/2026
The vulnerability identified in the Linux kernel network driver for Synopsys DesignWare MAC (stmmac) represents a critical logic error within the packet reception routine, specifically affecting how memory buffers are managed during high-load or resource-constrained scenarios. The core of this issue lies in the stmmac_rx function, which is responsible for processing incoming network packets received via DMA descriptors. Under normal operation, when an skb (socket buffer) is successfully built from a page obtained from the page pool, the driver correctly clears the reference to that page before recycling it back to the pool or handing it off to the networking stack. However, in the specific code path where napi_build_skb fails due to memory allocation constraints, the descriptor page was incorrectly recycled back to the page_pool_recycle_direct mechanism without clearing the buf->page pointer. This oversight leaves a stale reference pointing to a page that has already been returned to the system for reuse by other subsystems or processes.
This inconsistency in buffer lifecycle management creates a significant risk of use-after-free conditions and potential data corruption. Because the buf->pointer remains valid but points to recycled memory, subsequent calls to stmmac_rx_refill do not trigger a new allocation as intended. Instead, the driver proceeds to program this already-recycled page back into the RX descriptor for future DMA operations. This means that incoming network traffic may be written directly into memory pages that are no longer exclusively owned by the network stack and could potentially be in use by other kernel components or user-space applications if they were reallocated from the pool. Such a scenario violates fundamental memory safety principles, leading to undefined behavior where sensitive data might be overwritten or leaked across process boundaries.
From an industry standards perspective, this vulnerability aligns with CWE-416, Use After Free, as it involves accessing memory after it has been freed and potentially reallocated for other purposes. The failure to properly nullify pointers upon resource release is a classic manifestation of this weakness. Furthermore, in the context of attack vectors, while this specific flaw may primarily lead to stability issues such as kernel panics or network stack crashes due to corrupted descriptors, it also opens avenues for information disclosure if an attacker can trigger repeated allocation failures and observe side effects from shared memory pages. It does not directly map to a high-level ATT&CK technique like privilege escalation but falls under the broader category of exploitation potential through resource exhaustion leading to state corruption.
The operational impact of this vulnerability is primarily centered on system stability and network reliability. Under heavy load or when system memory is fragmented, napi_build_skb failures become more frequent, increasing the likelihood that stale pointers will be programmed into hardware descriptors. This can result in intermittent packet loss, corrupted data being processed by upper-layer protocols, or complete kernel crashes requiring a reboot. For environments running critical infrastructure services on Linux-based systems with stmmac network interfaces, such instability poses a direct threat to availability and integrity of network communications.
To mitigate this risk, the primary remediation is applying the upstream kernel patch that explicitly clears buf->page in the failure path of napi_build_skb within the stmmac_rx function. This ensures consistent behavior across all consumption sites in the driver, guaranteeing that recycled pages are not reused for DMA operations until they have been properly reallocated and initialized. Administrators should ensure their systems are updated to a kernel version where this fix is included. Additionally, monitoring network interface statistics for unusual error rates or packet drops may help identify instances where memory pressure was high enough to trigger the vulnerable code path before mitigation is applied. Regular auditing of driver updates and adherence to vendor security advisories remain essential practices for maintaining robust network subsystem integrity in Linux environments.