CVE-2026-63857
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
19/07/2026
Last modified:
27/07/2026
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit()<br />
<br />
The transmit loop in airoha_dev_xmit() reads fragment address and length<br />
during its final iteration, when the loop index equals<br />
skb_shinfo(skb)->nr_frags, at which point the fragment data is<br />
uninitialized. While these values are never consumed, the read itself is<br />
unsafe and may trigger a page fault. Fix this by avoiding the fragment<br />
read on the last iteration.<br />
Additionally, move the skb pointer from the first to the last used packet<br />
descriptor, so that airoha_qdma_tx_napi_poll() defers freeing the skb<br />
until the final descriptor is processed.
Impact
Base Score 3.x
9.80
Severity 3.x
CRITICAL