CVE-2026-45940

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: stmmac: fix oops when split header is enabled

For GMAC4, when split header is enabled, in some rare cases, the

hardware does not fill buf2 of the first descriptor with payload.

Thus we cannot assume buf2 is always fully filled if it is not

the last descriptor. Otherwise, the length of buf2 of the second

descriptor will be calculated wrong and cause an oops:

Unable to handle kernel paging request at virtual address ffff00019246bfc0

...

x2 : 0000000000000040 x1 : ffff00019246bfc0 x0 : ffff00009246c000

Call trace:

dcache_inval_poc+0x28/0x58 (P)

dma_direct_sync_single_for_cpu+0x38/0x6c

__dma_sync_single_for_cpu+0x34/0x6c

stmmac_napi_poll_rx+0x8f0/0xb60

__napi_poll.constprop.0+0x30/0x144

net_rx_action+0x160/0x274

handle_softirqs+0x1b8/0x1fc

...

To fix this, the PL bit-field in RDES3 register is used for all

descriptors, whether it is the last descriptor or not.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References