CVE-2026-63859

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63859", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.016Z", "datePublished": "2026-07-19T14:04:47.572Z", "dateUpdated": "2026-10-21T12:42:42.608Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:42:42.608Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue()\n\nSimilar to airoha_qdma_cleanup_rx_queue(), reset DMA TX descriptors in\nairoha_qdma_cleanup_tx_queue routine. Moreover, reset TX_DMA_IDX to\nTX_CPU_IDX to notify the NIC the QDMA TX ring is empty."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/airoha/airoha_eth.c"], "versions": [{"version": "23020f04932701d5c8363e60756f12b43b8ed752", "lessThan": "7b86b4c7767e932f59cd23b31587b73a03cb1dfc", "status": "affected", "versionType": "git"}, {"version": "23020f04932701d5c8363e60756f12b43b8ed752", "lessThan": "c0cfce4d76702dba9601a4020df1a0bc35806efc", "status": "affected", "versionType": "git"}, {"version": "23020f04932701d5c8363e60756f12b43b8ed752", "lessThan": "9b5d56fe389d68ede080c716e6f10895facaf7db", "status": "affected", "versionType": "git"}, {"version": "23020f04932701d5c8363e60756f12b43b8ed752", "lessThan": "3309965fe44c00fd65af7cef5016e9e782c021a7", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/airoha/airoha_eth.c"], "versions": [{"version": "6.11", "status": "affected"}, {"version": "0", "lessThan": "6.11", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.33", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.10", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.18.33"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.0.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/7b86b4c7767e932f59cd23b31587b73a03cb1dfc"}, {"url": "https://git.kernel.org/stable/c/c0cfce4d76702dba9601a4020df1a0bc35806efc"}, {"url": "https://git.kernel.org/stable/c/9b5d56fe389d68ede080c716e6f10895facaf7db"}, {"url": "https://git.kernel.org/stable/c/3309965fe44c00fd65af7cef5016e9e782c021a7"}], "title": "net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/airoha/airoha_eth.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "7b86b4c7767e932f59cd23b31587b73a03cb1dfc", "status": "affected", "version": "23020f04932701d5c8363e60756f12b43b8ed752", "versionType": "git"}, {"lessThan": "c0cfce4d76702dba9601a4020df1a0bc35806efc", "status": "affected", "version": "23020f04932701d5c8363e60756f12b43b8ed752", "versionType": "git"}, {"lessThan": "9b5d56fe389d68ede080c716e6f10895facaf7db", "status": "affected", "version": "23020f04932701d5c8363e60756f12b43b8ed752", "versionType": "git"}, {"lessThan": "3309965fe44c00fd65af7cef5016e9e782c021a7", "status": "affected", "version": "23020f04932701d5c8363e60756f12b43b8ed752", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/airoha/airoha_eth.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.11"}, {"lessThan": "6.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.33", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "568521F0-4243-4A07-B91E-C2368197A70B", "versionEndExcluding": "6.12.114", "versionStartIncluding": "6.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "96D99E49-380D-43AB-BDBA-25C3AD018A9C", "versionEndExcluding": "6.18.33", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A13475D2-59BF-4716-94B5-7C1D239A2CF4", "versionEndExcluding": "7.0.10", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue()\n\nSimilar to airoha_qdma_cleanup_rx_queue(), reset DMA TX descriptors in\nairoha_qdma_cleanup_tx_queue routine. Moreover, reset TX_DMA_IDX to\nTX_CPU_IDX to notify the NIC the QDMA TX ring is empty."}], "id": "CVE-2026-63859", "lastModified": "2026-10-26T17:14:07.027", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-07-19T15:16:52.750", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3309965fe44c00fd65af7cef5016e9e782c021a7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7b86b4c7767e932f59cd23b31587b73a03cb1dfc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9b5d56fe389d68ede080c716e6f10895facaf7db"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c0cfce4d76702dba9601a4020df1a0bc35806efc"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue()", "id": "2502310", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502310"}, "csaw": false, "cwe": "CWE-459", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue()\nSimilar to airoha_qdma_cleanup_rx_queue(), reset DMA TX descriptors in\nairoha_qdma_cleanup_tx_queue routine. Moreover, reset TX_DMA_IDX to\nTX_CPU_IDX to notify the NIC the QDMA TX ring is empty.", "A flaw was found in the Linux kernel's airoha network driver. The `airoha_qdma_cleanup_tx_queue()` routine, responsible for cleaning up transmit queues, was missing critical steps. This omission could lead to improper resetting of Direct Memory Access (DMA) transmit descriptors and incorrect notification to the network interface controller (NIC) about the state of the transmit ring. Consequently, this could result in resource mismanagement within the network driver."], "name": "CVE-2026-63859", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "impact": "important", "package_name": "erlang27", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63859\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63859\nhttps://lore.kernel.org/linux-cve-announce/2026071933-CVE-2026-63859-613f@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[23020f04932701d5c8363e60756f12b43b8ed752,c0cfce4d76702dba9601a4020df1a0bc35806efc)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[23020f04932701d5c8363e60756f12b43b8ed752,9b5d56fe389d68ede080c716e6f10895facaf7db)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[23020f04932701d5c8363e60756f12b43b8ed752,3309965fe44c00fd65af7cef5016e9e782c021a7)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.11"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.11)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.33,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.10,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-22T05:00:07.133649+00:00", "updated": "2026-10-26T18:45:14.282678+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}