CVE-2026-53215 Details

A vulnerability in the Linux kernel's Marvell MVPP2 Ethernet driver can lead to improper buffer management, potentially allowing hardware DMA to access memory that is no longer owned by the receive (RX) ring. This issue arises because the RX error handling process returns the current descriptor buffer to the hardware buffer management (BM) pool, a practice only valid while the driver retains ownership of the buffer. The function 'mvpp2_rx_refill()' can fail after a buffer has been assigned to XDP (eXpress Data Path) or attached to a socket buffer (skb). When this happens, 'mvpp2_run_xdp()' may have already recycled, redirected, or queued the page for XDP_TX, and freeing an skb also retires the associated data buffer. The vulnerability has been addressed by modifying the buffer refill process to ensure that RX buffers are properly managed before being handed off to XDP or skb, preventing the return of buffers to the BM pool that could lead to unauthorized memory access.

Users can apply the latest patches available in the Linux kernel stable tree to address this vulnerability. Instructions for downloading the patched version can be found in the Linux kernel documentation.