CVE-2026-31658None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() When dma_map_single() fails in tse_start_xmit(), the function returns NETDEV_TX_OK without freei…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.1%
In the Linux kernel, the following vulnerability has been resolved:
net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit()
When dma_map_single() fails in tse_start_xmit(), the function returns NETDEV_TX_OK without freeing the skb. Since NETDEV_TX_OK tells the stack the packet was consumed, the skb is never freed, leaking memory on every DMA mapping failure.
Add dev_kfree_skb_any() before returning to properly free the skb.
Linux >= bbd2190ce96d8fce031f0526c1f970b68adc9d1a < ae2cd46f57f422b51aedd406ff5d75cbff401d5dLinux >= bbd2190ce96d8fce031f0526c1f970b68adc9d1a < cb1d318702fdf643061350d164250198df4116f2Linux >= bbd2190ce96d8fce031f0526c1f970b68adc9d1a < d5ec406f0543bd6cdfd563b08015fdec8c4d5712Linux >= bbd2190ce96d8fce031f0526c1f970b68adc9d1a < 2eb9d67704ca8f1101f7435b85f113ede471f9f2Linux >= bbd2190ce96d8fce031f0526c1f970b68adc9d1a < 9f3ec44aeb58501d11834048d5d0dbaeacb6d4e7Linux >= bbd2190ce96d8fce031f0526c1f970b68adc9d1a < 60f462cd2716d86bd2174f9d5e035c9278f30480Linux >= bbd2190ce96d8fce031f0526c1f970b68adc9d1a < 3aca300e88afe56afb000cdc4c65383014fb17f9Linux >= bbd2190ce96d8fce031f0526c1f970b68adc9d1a < 6dede3967619b5944003227a5d09fdc21ed57d10Linux 3.15Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-90068NoneIn the Linux kernel, the following vulnerability has been resolved: ASoC: dapm: Fix off-by-one check on the second enum channel The snd_soc_dapm_put_enum_double() rejects item[0] once it reaches e->items, but it lets item[1] be equal t…
CVE-2026-90090NoneIn the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path btmtksdio_tx_packet() rounds the transfer size up to the SDIO block size of 256 bytes, but hands the ho…
CVE-2026-90093High· 7.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: access chan->conn safely in get/setsockopt Since commit b66774b48dd9 ("Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref") l2cap_chan:…
CVE-2026-90098NoneIn the Linux kernel, the following vulnerability has been resolved: net: sparx5: fix sleep in atomic context in MAC table access sparx5_set_rx_mode() runs with netif_addr_lock_bh held and iterates dev->mc via __dev_mc_sync(), which per…
CVE-2026-90121NoneIn the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v5: Clear per-CPU IRS data on teardown IRS affinity setup publishes an IRS pointer and IAFFID state in the per-CPU data before the remaining IRS initializa…
CVE-2026-90156NoneIn the Linux kernel, the following vulnerability has been resolved: ksmbd: safely discard unregistered deferred locks When vfs_lock_file() defers a lock, smb2_lock() puts its ksmbd_lock on rollback_list before allocating and registerin…