CVE-2026-31649

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: stmmac: fix integer underflow in chain mode

The jumbo_frm() chain-mode implementation unconditionally computes

len = nopaged_len - bmax;

where nopaged_len = skb_headlen(skb) (linear bytes only) and bmax is

BUF_SIZE_8KiB or BUF_SIZE_2KiB. However, the caller stmmac_xmit()

decides to invoke jumbo_frm() based on skb->len (total length including

page fragments):

is_jumbo = stmmac_is_jumbo_frm(priv, skb->len, enh_desc);

When a packet has a small linear portion (nopaged_len <= bmax) but a

large total length due to page fragments (skb->len > bmax), the

subtraction wraps as an unsigned integer, producing a huge len value

(~0xFFFFxxxx). This causes the while (len != 0) loop to execute

hundreds of thousands of iterations, passing skb->data + bmax * i

pointers far beyond the skb buffer to dma_map_single(). On IOMMU-less

SoCs (the typical deployment for stmmac), this maps arbitrary kernel

memory to the DMA en

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References