CVE-2026-64055 Details
Description
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Carry over frag counter The gmac_rx() NAPI poll function assembles packets in an SKB from a ring buffer. If the ring buffer gets completely emptied during a poll cycle, we exit gmac_rx(), but the packet is not yet completely assembled in the SKB, yet the fragment counter frag_nr is reset to zero on the next invocation. Solve this by making the RX fragment counter a part of the port struct, and carry it over between invocations. Reset the fragment counter only right after calling napi_gro_frags(), on error (after calling napi_free_frags()) or if stopping the port. Reset it in some place where not strictly necessary just to emphasize what is going on. This was found by Sashiko during normal patch review.
A vulnerability exists in the Linux kernel's handling of Ethernet packet assembly in the Cortina Gemini driver. The issue arises in the gmac_rx() NAPI poll function, which processes packets from a ring buffer. If the buffer is completely emptied during a polling cycle, the function exits before the packet is fully assembled in the socket buffer (SKB). However, the fragment counter is prematurely reset to zero on the next invocation. This vulnerability affects several versions of the Linux kernel.
The vulnerability has been addressed by modifying the driver to make the RX fragment counter a part of the port structure, allowing it to carry over between function invocations. This change ensures that the fragment counter is only reset at appropriate times, such as after calling napi_gro_frags(), on error, or when stopping the port.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/46806096f35b8d3dfa2f321ddd77f597edcdb85f | kernel.org | Patch |
| https://git.kernel.org/stable/c/7123cf481e21b54eb6adc4cb0d8dc2876aeaee41 | kernel.org | Patch |
| https://git.kernel.org/stable/c/75105fcf73f1ce7d9f769aaefec6e6d6645d5ac0 | kernel.org | Patch |
| https://git.kernel.org/stable/c/78cf08b3be47c28f07008a76c932bad7cdffa9d8 | kernel.org | Patch |
| https://git.kernel.org/stable/c/7af1fabdee744b7995fe01b30b77dfc397657cb5 | kernel.org | Patch |
| https://git.kernel.org/stable/c/c373b34877afea61c89e0dd2e38948c624249b9b | kernel.org | Patch |
| https://git.kernel.org/stable/c/df31e3b64455293df1ea89c7da7d5c9bfbcdd253 | kernel.org | Patch |
| https://git.kernel.org/stable/c/ebd8ec2b309e3a447851b456ccaf8fb39f3661e7 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 4.16, < 5.10.258 >= 5.11, < 5.15.209 >= 5.16, < 6.1.175 >= 6.2, < 6.6.142 >= 6.7, < 6.12.92 >= 6.13, < 6.18.34 >= 6.19, < 7.0.11 7.1 rc1 7.1 rc2 7.1 rc3 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 2, 2026 | Initial Analysis | [email protected] |
| Jul 20, 2026 | CVE Modified | kernel.org |
| Jul 19, 2026 | New CVE Received | kernel.org |