CVE-2026-31501

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path

cppi5_hdesc_get_psdata() returns a pointer into the CPPI descriptor.

In both emac_rx_packet() and emac_rx_packet_zc(), the descriptor is

freed via k3_cppi_desc_pool_free() before the psdata pointer is used

by emac_rx_timestamp(), which dereferences psdata[0] and psdata[1].

This constitutes a use-after-free on every received packet that goes

through the timestamp path.

Defer the descriptor free until after all accesses through the psdata

pointer are complete. For emac_rx_packet(), move the free into the

requeue label so both early-exit and success paths free the descriptor

after all accesses are done. For emac_rx_packet_zc(), move the free to

the end of the loop body after emac_dispatch_skb_zc() (which calls

emac_rx_timestamp()) has returned.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References