CVE-2026-98131: Linux Kernel STMMAC DMA Mapping Leak

CVE-2026-98131 Overview

CVE-2026-98131 is a resource leak vulnerability in the Linux kernel's stmmac network driver. The flaw exists in the stmmac_tso_xmit() function, which handles TCP Segmentation Offload (TSO) transmission for STMicroelectronics MAC-based Ethernet controllers. When the DMA mapping of a socket buffer (skb) fragment fails, the kernel drops the frame but fails to release the DMA mappings already created for the linear portion and prior fragments. Each failed transmission leaks DMA mappings, progressively exhausting a finite kernel resource over time.

Critical Impact
Repeated transmission failures can exhaust DMA mapping resources on affected systems, degrading network driver functionality and potentially causing device instability.

Affected Products

Linux kernel versions containing the vulnerable stmmac_tso_xmit() implementation
Systems using the stmmac driver for STMicroelectronics Ethernet MAC controllers
Embedded platforms and SoCs relying on stmmac for networking (common on ARM-based boards)

Discovery Timeline

2026-09-25 - CVE-2026-98131 published to the National Vulnerability Database
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-98131

Vulnerability Analysis

The vulnerability resides in the transmit path of the stmmac network driver, specifically within stmmac_tso_xmit(). This function constructs multiple descriptors for a single TSO frame by DMA-mapping the linear portion of the skb followed by each paged fragment. The implementation did not provide a proper error-unwind path when a mid-sequence DMA mapping failed.

When dma_map_page() or an equivalent fails for an intermediate fragment, the function drops the frame but leaves the preceding successful mappings allocated. Each occurrence consumes a DMA mapping slot without ever releasing it, resulting in a cumulative leak. Over time, this can exhaust the IOMMU or swiotlb pool, impairing all subsequent DMA operations on the system.

Root Cause

The root cause is a missing cleanup path on partial-failure during multi-descriptor DMA mapping — a classic Memory Leak pattern in error handling code. The function allocated DMA resources incrementally but lacked a rollback routine to walk back over successfully allocated descriptors upon failure.

The upstream fix traverses the descriptors previously used for the frame and releases each with stmmac_free_tx_buffer(). The patch additionally calls stmmac_release_tx_desc() to unmap the DMA buffers associated with each descriptor, ensuring complete resource reclamation.

Attack Vector

The vulnerability is reachable through the normal network transmit path. Triggering the leak requires DMA mapping failures, which typically occur under memory pressure, IOMMU exhaustion, or constrained swiotlb buffers. A local workload that stresses network transmission under low-memory conditions could accelerate the leak and degrade system networking. No remote exploitation vector or privilege escalation primitive is documented in the advisory.

The vulnerability is described in the fix commits referenced in the Linux Kernel Commit A5D9464 and Linux Kernel Commit E85ADAA.

Detection Methods for CVE-2026-98131

Indicators of Compromise

Progressive growth in DMA mapping usage reported through /proc/meminfo or IOMMU statistics without a corresponding workload increase
Kernel log messages indicating DMA mapping failures, swiotlb exhaustion, or stmmac transmit errors
Network interface instability or dropped frames correlated with memory pressure on systems using stmmac

Detection Strategies

Audit running kernel versions on devices with STMicroelectronics Ethernet controllers and compare against patched stable releases
Monitor dmesg for repeated stmmac_tso_xmit warnings or DMA allocation failures over extended runtime
Instrument production hosts with eBPF probes on dma_map_page and dma_unmap_page to identify imbalance in paired calls originating from the stmmac driver

Monitoring Recommendations

Track long-term trends in IOMMU/swiotlb consumption on embedded Linux fleets and alert on sustained upward drift
Correlate network transmit errors with system memory-pressure events in centralized log analytics
Baseline stmmac driver counters including dropped TX frames and compare across identical hardware for anomalies

How to Mitigate CVE-2026-98131

Immediate Actions Required

Identify all systems running the stmmac driver and inventory their kernel versions
Schedule kernel updates to a stable release containing commits a5d9464 and e85adaa
Reduce exposure by minimizing sustained memory pressure on affected devices until patches are deployed

Patch Information

The upstream fix is contained in two Linux kernel commits: Linux Kernel Commit A5D9464 and Linux Kernel Commit E85ADAA. The patch walks back over descriptors used by the failed frame and releases each with stmmac_free_tx_buffer(), then calls stmmac_release_tx_desc() to unmap associated DMA buffers. Administrators should apply vendor-provided kernel updates that incorporate these commits.

Workarounds

Disable TCP Segmentation Offload on affected interfaces using ethtool -K <iface> tso off to bypass the vulnerable transmit path
Reboot affected systems periodically to reclaim leaked DMA mappings until a patched kernel is deployed
Avoid workloads that sustain memory pressure on hosts with the vulnerable stmmac driver

bash

# Configuration example: disable TSO on an stmmac interface
sudo ethtool -K eth0 tso off
sudo ethtool -k eth0 | grep tcp-segmentation-offload