Bug 2502280 (CVE-2026-63857)

Summary:	CVE-2026-63857 kernel: net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit()
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	unspecified	CC:	nicolasthorntonnn284, rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's `airoha` network driver. The transmit function `airoha_dev_xmit()` attempts to read uninitialized memory during its final processing loop. This unsafe memory access may lead to a system crash, resulting in a Denial of Service (DoS).	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-19 15:01:45 UTC

In the Linux kernel, the following vulnerability has been resolved:

net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit()

The transmit loop in airoha_dev_xmit() reads fragment address and length
during its final iteration, when the loop index equals
skb_shinfo(skb)->nr_frags, at which point the fragment data is
uninitialized. While these values are never consumed, the read itself is
unsafe and may trigger a page fault. Fix this by avoiding the fragment
read on the last iteration.
Additionally, move the skb pointer from the first to the last used packet
descriptor, so that airoha_qdma_tx_napi_poll() defers freeing the skb
until the final descriptor is processed.

Comment 1 Keith Grant 2026-07-21 18:45:14 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026071932-CVE-2026-63857-2bda@gregkh/T

Comment 2 JesseWolfe 2026-07-23 09:09:17 UTC

I really appreciate the in-depth analysis of CVE-2026-63857! It’s crucial for us to tackle these uninitialized fragment address issues, especially given how they can impact overall system stability. I had a similar experience when diagnosing TCP issues in our network; it taught me the importance of thorough initialization. Thanks for shedding light on such an important topic! https://spacewavesgame.io