CVE-2026-98571

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98571", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.357Z", "datePublished": "2026-10-18T15:18:37.195Z", "dateUpdated": "2026-10-19T09:21:56.739Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:21:56.739Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: clear stale buf->page after recycling on skb build failure\n\nIn stmmac_rx(), when napi_build_skb() fails the descriptor page is\nrecycled back to the page pool with page_pool_recycle_direct(), but\nbuf->page is left pointing at the recycled page, unlike every other\nconsumption site in the function which clears the pointer after handing\nthe page away.\n\nWith the stale pointer stmmac_rx_refill() skips the replacement\nallocation and programs the already-recycled page back into the RX\ndescriptor.\n\nClear buf->page on the napi_build_skb() failure path to keep the buffer\nlifecycle consistent with the other consumption sites."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"], "versions": [{"version": "df542f669307918f054a17878ff6dd1ddbb2fe18", "lessThan": "501baaeca7d128fa0a2f6953cf5873c5b0d7cf89", "status": "affected", "versionType": "git"}, {"version": "df542f669307918f054a17878ff6dd1ddbb2fe18", "lessThan": "298673397ea3f6f5811b84f0d9f71eac71dda2e3", "status": "affected", "versionType": "git"}, {"version": "df542f669307918f054a17878ff6dd1ddbb2fe18", "lessThan": "0a7822e34a0bfde31b194ac3da3253e5032b44cc", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"], "versions": [{"version": "6.14", "status": "affected"}, {"version": "0", "lessThan": "6.14", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/501baaeca7d128fa0a2f6953cf5873c5b0d7cf89"}, {"url": "https://git.kernel.org/stable/c/298673397ea3f6f5811b84f0d9f71eac71dda2e3"}, {"url": "https://git.kernel.org/stable/c/0a7822e34a0bfde31b194ac3da3253e5032b44cc"}], "title": "net: stmmac: clear stale buf->page after recycling on skb build failure", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "501baaeca7d128fa0a2f6953cf5873c5b0d7cf89", "status": "affected", "version": "df542f669307918f054a17878ff6dd1ddbb2fe18", "versionType": "git"}, {"lessThan": "298673397ea3f6f5811b84f0d9f71eac71dda2e3", "status": "affected", "version": "df542f669307918f054a17878ff6dd1ddbb2fe18", "versionType": "git"}, {"lessThan": "0a7822e34a0bfde31b194ac3da3253e5032b44cc", "status": "affected", "version": "df542f669307918f054a17878ff6dd1ddbb2fe18", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.14"}, {"lessThan": "6.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: clear stale buf->page after recycling on skb build failure\n\nIn stmmac_rx(), when napi_build_skb() fails the descriptor page is\nrecycled back to the page pool with page_pool_recycle_direct(), but\nbuf->page is left pointing at the recycled page, unlike every other\nconsumption site in the function which clears the pointer after handing\nthe page away.\n\nWith the stale pointer stmmac_rx_refill() skips the replacement\nallocation and programs the already-recycled page back into the RX\ndescriptor.\n\nClear buf->page on the napi_build_skb() failure path to keep the buffer\nlifecycle consistent with the other consumption sites."}], "id": "CVE-2026-98571", "lastModified": "2026-10-19T10:19:15.207", "metrics": {}, "published": "2026-10-18T16:17:09.363", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0a7822e34a0bfde31b194ac3da3253e5032b44cc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/298673397ea3f6f5811b84f0d9f71eac71dda2e3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/501baaeca7d128fa0a2f6953cf5873c5b0d7cf89"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net: stmmac: clear stale buf->page after recycling on skb build failure", "id": "2554916", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554916"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: stmmac: clear stale buf->page after recycling on skb build failure\nIn stmmac_rx(), when napi_build_skb() fails the descriptor page is\nrecycled back to the page pool with page_pool_recycle_direct(), but\nbuf->page is left pointing at the recycled page, unlike every other\nconsumption site in the function which clears the pointer after handing\nthe page away.\nWith the stale pointer stmmac_rx_refill() skips the replacement\nallocation and programs the already-recycled page back into the RX\ndescriptor.\nClear buf->page on the napi_build_skb() failure path to keep the buffer\nlifecycle consistent with the other consumption sites.", "A flaw was found in the Linux kernel's stmmac network driver. This vulnerability can lead to a Denial of Service (DoS) or memory corruption when processing incoming network traffic under resource constraints. When the driver fails to allocate a network packet buffer, it recycles the underlying memory page without clearing its reference pointer. An attacker sending network packets during memory pressure could trigger this condition, causing the driver to reuse the recycled memory page and crash the system."], "name": "CVE-2026-98571", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98571\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98571\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98571.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[df542f669307918f054a17878ff6dd1ddbb2fe18,501baaeca7d128fa0a2f6953cf5873c5b0d7cf89)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[df542f669307918f054a17878ff6dd1ddbb2fe18,298673397ea3f6f5811b84f0d9f71eac71dda2e3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[df542f669307918f054a17878ff6dd1ddbb2fe18,0a7822e34a0bfde31b194ac3da3253e5032b44cc)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.14"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.14)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.55,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T23:15:14.329618+00:00", "updated": "2026-10-20T16:45:14.065724+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}