CVE-2026-31649

A flaw was found in the Linux kernel's stmmac network driver. An integer underflow vulnerability in the jumbo_frm() function, when processing specially crafted fragmented network packets, can lead to a memory disclosure and potential memory corruption. This issue allows an attacker to read arbitrary kernel memory and potentially corrupt it, impacting the system's integrity and confidentiality.

A flaw was found in the Linux kernel's stmmac network driver. In chain mode, the jumbo_frm() function computes the descriptor length as nopaged_len - bmax using only the skb's linear data length, while stmmac_xmit() selects the jumbo path based on the total packet length including page fragments. When a packet with a small linear portion but a large total length is transmitted, the unsigned subtraction underflows, producing a huge length value that makes the transmit loop map kernel memory far beyond the skb buffer to the DMA engine. On IOMMU-less systems (the typical deployment for stmmac), this can result in kernel memory disclosure and potential memory corruption by the DMA hardware. Red Hat rates this flaw as having Moderate security impact because triggering it requires the ability to transmit specially crafted fragmented packets through a local stmmac interface, implying privileged local access (CVSS 6.0, AV:L/AC:L/PR:H); this differs substantially from the upstream CVEORG score of 9.8, which assumes a remote, unauthenticated network attack. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable code is not present in those kernels. On the affected RHEL 8, 9, and 10 kernel and kernel-rt update streams the fix is currently deferred: given the Moderate rating and the privileged local access required to trigger the underflow, a fix is not planned for those streams at this time. The residual risk is that a privileged local user able to send crafted fragmented packets through an stmmac-based interface could cause kernel memory disclosure or corruption. Some affected streams are out of active support scope. For Red Hat In-Vehicle OS 2.0, where affectedness is delegated, the same impact applies and remediation is being pursued through the delegated process.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.