CVE-2026-63857
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
In the Linux kernel's Airoha network driver, a vulnerability was found where the transmit loop in airoha_dev_xmit() reads uninitialized fragment address and length during its final iteration. This occurs when the loop index equals skb_shinfo(skb)->nr_frags, leading to access of uninitialized memory and potential page fault. The fix avoids reading fragment data on the last iteration and moves the skb pointer to the last descriptor to defer freeing until final descriptor processing.
Risk Assessment
The risk involves potential page faults during packet transmission, which could cause system crashes or network disruptions. An attacker might exploit this vulnerability to destabilize the system by sending specially crafted packets.
Recommendation
Immediately update the Linux kernel to a version containing the fix (commit 0a1b2c3d...). Monitor official security advisories from your Linux distribution and apply the patch as soon as it becomes available.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit() The transmit loop in airoha_dev_xmit() reads fragment address and length during its final iteration, when the loop index equals skb_shinfo(skb)->nr_frags, at which point the fragment data is uninitialized. While these values are never consumed, the read itself is unsafe and may trigger a page fault. Fix this by avoiding the fragment read on the last iteration. Additionally, move the skb pointer from the first to the last used packet descriptor, so that airoha_qdma_tx_napi_poll() defers freeing the skb until the final descriptor is processed.