CVE-2026-53217 Overview
CVE-2026-53217 is a Linux kernel vulnerability in the Marvell PPv2 (mvpp2) network driver. The driver programs the receive (RX) queue packet offset so hardware writes received data at dma_addr + MVPP2_SKB_HEADROOM. The previous CPU sync logic started at dma_addr and only covered rx_bytes + MVPP2_MH_SIZE bytes. This caused the sync to cover unused headroom and miss the same number of bytes at the packet tail. On non-coherent DMA systems, the CPU can read stale cache contents from the end of received frames.
Critical Impact
On non-coherent DMA platforms using the mvpp2 driver, the CPU can process stale cache data at the tail of received network packets, potentially leading to data integrity issues in network traffic processing.
Affected Products
- Linux kernel versions containing the mvpp2 Marvell PPv2 Ethernet driver
- Systems using Marvell Armada SoCs with non-coherent DMA
- Networking infrastructure devices built on affected Marvell platforms
Discovery Timeline
- 2026-06-25 - CVE-2026-53217 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-53217
Vulnerability Analysis
The mvpp2 driver configures hardware to write received frame data at an offset of MVPP2_SKB_HEADROOM from the DMA buffer base address. After packet reception, the driver must invalidate or synchronize the CPU cache covering the region hardware wrote to, ensuring the CPU reads fresh data rather than cached values.
The defective sync call started at dma_addr (the buffer base) and covered rx_bytes + MVPP2_MH_SIZE bytes. Because hardware actually wrote data starting at dma_addr + MVPP2_SKB_HEADROOM, the sync covered the unused headroom region at the start of the buffer and stopped MVPP2_SKB_HEADROOM bytes short of the actual packet tail.
Root Cause
The root cause is an incorrect DMA sync range in the RX path. The sync offset was zero instead of MVPP2_SKB_HEADROOM, leaving the trailing bytes of received frames outside the synced region. On architectures with non-coherent DMA, the CPU cache for those trailing bytes is not invalidated, so reads return stale data instead of the bytes hardware wrote.
Attack Vector
This is a data integrity bug exposed during normal network receive operations. Triggering does not require a crafted exploit. Any system using mvpp2 on a non-coherent DMA platform can observe corrupted packet tails under normal traffic load. The fix replaces the prior call with dma_sync_single_range_for_cpu() using MVPP2_SKB_HEADROOM as the range offset, so the sync covers the Marvell header and the actual packet payload written by hardware.
No verified public proof-of-concept code is available for this issue. Technical details are documented in the upstream stable kernel commits referenced by the CVE.
Detection Methods for CVE-2026-53217
Indicators of Compromise
- Intermittent network packet corruption on systems using Marvell PPv2 Ethernet controllers
- Checksum failures or malformed frames reported by the network stack on mvpp2 interfaces
- Application-layer protocol errors correlating with received traffic on affected hardware
Detection Strategies
- Inventory Linux hosts running kernels with mvpp2 and identify those on non-coherent DMA SoC platforms
- Cross-reference installed kernel versions against the upstream stable commits listed in the CVE references
- Audit kernel changelogs for backported fixes referencing net: mvpp2: sync RX data at the hardware packet offset
Monitoring Recommendations
- Monitor ethtool -S counters on mvpp2 interfaces for RX errors, dropped frames, and checksum mismatches
- Track higher-layer retransmission rates on links served by affected Marvell hardware
- Alert on unexpected protocol parsing errors in services receiving traffic over mvpp2 NICs
How to Mitigate CVE-2026-53217
Immediate Actions Required
- Identify all systems running the mvpp2 driver and confirm whether the underlying SoC uses non-coherent DMA
- Schedule kernel updates to versions containing the fix from the referenced stable tree commits
- Prioritize patching on networking appliances and embedded devices that handle production traffic
Patch Information
The fix replaces the previous sync call with dma_sync_single_range_for_cpu(), passing MVPP2_SKB_HEADROOM as the range offset so the synced region covers the Marvell header and packet data actually written by hardware. The patch is available across multiple stable branches via the upstream commits, including commit 1802356, commit 19f8bc1, commit 2354800, commit 60412bd, commit a13199f, commit a3ad9b5, commit bede0f4, and commit e302206.
Workarounds
- No software workaround eliminates the underlying cache coherency issue on non-coherent DMA hardware
- Apply the upstream stable kernel patch as the authoritative remediation
- Where patching is not immediately feasible, reduce reliance on mvpp2 interfaces for integrity-sensitive workloads until the kernel is updated
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
