CVE-2026-31649: Linux Kernel Privilege Escalation Flaw

CVE-2026-31649 Overview

CVE-2026-31649 is an integer underflow vulnerability [CWE-190] in the Linux kernel's stmmac Ethernet driver. The flaw resides in the jumbo_frm() chain-mode implementation, which handles transmission of jumbo frames. When a packet has a small linear portion but a large total length due to page fragments, an unsigned subtraction wraps around, producing a len value near 0xFFFFFFFF. This causes the transmit loop to pass pointers far beyond the socket buffer to dma_map_single(). On IOMMU-less systems-on-chip (SoCs), this maps arbitrary kernel memory to the DMA engine.

Critical Impact
The flaw enables kernel memory disclosure and potential memory corruption from hardware DMA on IOMMU-less SoCs running the stmmac driver in chain mode.

Affected Products

Linux Kernel (multiple stable branches, including the 3.2 line)
Linux Kernel 7.0 release candidates rc1 through rc7
Systems using the stmmac (STMicroelectronics MAC) network driver, typically embedded SoCs without an IOMMU

Discovery Timeline

2026-04-24 - CVE-2026-31649 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-31649

Vulnerability Analysis

The stmmac driver implements jumbo frame transmission through the jumbo_frm() function in chain mode. The function unconditionally computes len = nopaged_len - bmax, where nopaged_len equals skb_headlen(skb) (linear bytes only) and bmax is BUF_SIZE_8KiB or BUF_SIZE_2KiB.

The caller stmmac_xmit() decides to invoke jumbo_frm() based on skb->len, which includes page fragments. When a packet contains a small linear portion (nopaged_len <= bmax) but a large total length from page fragments (skb->len > bmax), the subtraction wraps as an unsigned integer. This produces a len value approaching 0xFFFFxxxx.

Root Cause

The root cause is a mismatch between the length metric used to gate jumbo-frame handling and the length metric used inside jumbo_frm() to compute descriptor counts. stmmac_is_jumbo_frm() evaluates the total skb->len, while jumbo_frm() operates on skb_headlen(skb). Without clamping, the subtraction can underflow whenever the linear header fits in one descriptor but fragments push the total length above bmax.

Attack Vector

An attacker who can deliver crafted network traffic, or trigger transmission of a specifically structured socket buffer through a local interface, can drive the underflow. The resulting while (len != 0) loop executes hundreds of thousands of iterations, advancing skb->data + bmax * i pointers far beyond the SKB allocation. Each iteration calls dma_map_single() on attacker-influenced kernel addresses.

On IOMMU-less SoCs, which is the typical deployment scenario for stmmac, the DMA engine then reads arbitrary kernel memory and writes it to the wire. This constitutes a kernel memory disclosure primitive and a potential write primitive via inbound DMA, depending on hardware behavior. No verified public proof-of-concept is currently associated with this CVE.

Detection Methods for CVE-2026-31649

Indicators of Compromise

Unexpected dma_map_single() failures or DMA-API warnings emitted by the kernel during stmmac transmission paths.
Anomalous outbound Ethernet frames containing fragments of kernel memory rather than legitimate payload.
Kernel logs referencing stmmac transmit errors, descriptor ring corruption, or swiotlb mapping failures on affected SoCs.

Detection Strategies

Audit running kernel versions across embedded Linux fleets and cross-reference against the patched commits referenced in the kernel.org advisories.
Use kernel runtime instrumentation (ftrace, kprobes) on stmmac_xmit and jumbo_frm to flag invocations where skb->len exceeds bmax while skb_headlen(skb) is below bmax.
Capture and inspect transmitted frames on test benches to detect kernel data leakage from devices running unpatched stmmac builds.

Monitoring Recommendations

Forward kernel logs from embedded and SoC-based Linux hosts into a centralized analytics platform and alert on stmmac ring or DMA errors.
Monitor network egress from IoT and SoC fleets for unusually large frames or payload entropy patterns inconsistent with application traffic.
Track kernel package versions through configuration management and flag hosts that diverge from the patched baseline.

How to Mitigate CVE-2026-31649

Immediate Actions Required

Apply the upstream Linux kernel patches listed in the kernel.org references to all affected stable branches.
Prioritize patching IOMMU-less embedded systems and SoCs that use the stmmac driver, since these face the highest impact.
Rebuild and redeploy custom kernels for embedded devices, verifying that the corrected jumbo_frm() logic is present.

Patch Information

The upstream fix introduces a buf_len local variable clamped to min(nopaged_len, bmax). Computing len = nopaged_len - buf_len is then always safe and evaluates to zero when the linear portion fits in a single descriptor, causing the while (len != 0) loop to be skipped. Patch commits are available at Kernel Commit 10d12b9240e, Kernel Commit 275bdf762e8, Kernel Commit 2c91b399122, Kernel Commit 513e06735f5, Kernel Commit 51f4e090b9f, Kernel Commit 6fca757c203, Kernel Commit a2b68a9a476, and Kernel Commit b7b8012193fd.

Workarounds

Disable jumbo frame support on stmmac interfaces where feasible by keeping the interface MTU at the standard 1500 bytes.
Constrain workloads on affected hosts to avoid transmitting paged SKBs through stmmac, for example by disabling scatter-gather (ethtool -K <iface> sg off) until the patch is deployed.
Where supported by hardware, enable an IOMMU to limit the scope of arbitrary DMA mappings issued by the driver.

bash

# Configuration example: reduce exposure on unpatched stmmac interfaces
ip link set dev eth0 mtu 1500
ethtool -K eth0 sg off tso off gso off