CVE-2026-31658: Linux Kernel DOS Vulnerability

CVE-2026-31658 Overview

CVE-2026-31658 is a memory leak vulnerability in the Linux kernel's Altera Triple-Speed Ethernet (TSE) network driver. The flaw resides in the tse_start_xmit() transmit function, where a failed dma_map_single() call returns NETDEV_TX_OK without freeing the associated socket buffer (skb). Because NETDEV_TX_OK signals to the network stack that the packet was consumed, the kernel never reclaims the leaked skb. Each DMA mapping failure leaks kernel memory, and sustained failures can exhaust system resources on hosts using Altera TSE hardware. The issue is tracked under [CWE-401: Missing Release of Memory after Effective Lifetime].

Critical Impact
A local attacker or fault condition triggering repeated DMA mapping failures on systems using the Altera TSE driver can cause progressive kernel memory exhaustion and denial of service.

Affected Products

Linux Kernel (mainline, including 7.0 release candidates rc1 through rc7)
Linux Kernel 3.15 and subsequent stable branches containing the altera-tse driver
Embedded and FPGA-based systems using Altera Triple-Speed Ethernet network controllers

Discovery Timeline

2026-04-24 - CVE-2026-31658 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-31658

Vulnerability Analysis

The vulnerability exists in drivers/net/ethernet/altera/altera_tse_main.c, specifically in the tse_start_xmit() function that handles packet transmission for Altera Triple-Speed Ethernet adapters. When the driver maps an outgoing skb for DMA using dma_map_single(), the function may fail under memory pressure, IOMMU constraints, or DMA address space exhaustion.

The defective code path returns NETDEV_TX_OK upon mapping failure. This return value tells the Linux network stack that the driver has accepted ownership of the packet and either transmitted or discarded it. The stack therefore does not free the skb, but the driver also fails to release it. Every failed transmission leaks the buffer permanently from kernel memory.

The fix introduces a call to dev_kfree_skb_any() before returning, ensuring the buffer is released regardless of context.

Root Cause

The root cause is incorrect error-path handling in the network transmit routine. The driver violated the kernel's ndo_start_xmit contract by signaling packet acceptance without taking responsibility for the buffer's lifecycle. This pattern matches [CWE-401], where allocated resources are not released along all execution paths.

Attack Vector

Exploitation requires local access with the ability to generate network traffic or induce DMA mapping pressure. An attacker with low privileges on a system using the Altera TSE driver can repeatedly trigger conditions that cause dma_map_single() to fail, such as exhausting DMA-capable memory regions or saturating the IOMMU translation cache. Each failure leaks one skb, gradually consuming kernel memory until the system becomes unstable or unresponsive. The vulnerability does not enable code execution or information disclosure.

No public exploit is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-31658

Indicators of Compromise

Progressive decline in available kernel memory (MemAvailable in /proc/meminfo) on systems using the altera_tse module
Increasing SUnreclaim slab counters with sustained growth of skbuff_head_cache allocations
Kernel log entries referencing DMA mapping failures on Altera TSE interfaces
Network interface transmit counters incrementing while throughput degrades

Detection Strategies

Audit running kernel versions across the fleet and identify hosts loading the altera_tse driver via lsmod or /proc/modules
Monitor slab allocator statistics with slabtop and track skbuff_head_cache growth over time
Correlate DMA failure messages in dmesg with rising memory utilization on affected hosts

Monitoring Recommendations

Forward kernel logs and memory metrics from FPGA-based and embedded Linux hosts to a centralized logging platform for trend analysis
Alert on sustained skbuff cache growth that does not correlate with workload increases
Track kernel version inventory to flag systems still running pre-patch builds containing the altera-tse driver

How to Mitigate CVE-2026-31658

Immediate Actions Required

Apply the upstream kernel patch from the stable trees referenced in the vendor advisories as soon as distribution updates are available
Identify all systems loading the altera_tse module and prioritize patching for those exposed to untrusted local users
Restrict local shell and container access on affected hosts until patches are deployed

Patch Information

The fix adds dev_kfree_skb_any() to the error path in tse_start_xmit() before returning NETDEV_TX_OK. The patch has been backported across multiple stable branches. Apply the relevant commit for your kernel version from the Linux Kernel Stable Tree or one of the related backport commits referenced in the NVD advisory.

Workarounds

Unload the altera_tse module on systems that do not require the Altera TSE interface using modprobe -r altera_tse
Reboot affected systems periodically to reclaim leaked memory until a patched kernel is deployed
Limit local user access and constrain container DMA-related capabilities to reduce the ability to trigger mapping failures

bash

# Verify whether the altera_tse driver is loaded
lsmod | grep altera_tse

# Check current kernel version against patched stable releases
uname -r

# If the driver is unused, blacklist it to prevent loading
echo 'blacklist altera_tse' | sudo tee /etc/modprobe.d/blacklist-altera-tse.conf
sudo update-initramfs -u