---
id: CVE-2026-45940
title: 'net: stmmac: fix oops when split header is enabled'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net: stmmac: fix oops when split header is enabled

  For GMAC4, when split header is enabled, in some rare cases, the
  hardware does not fill buf2 of the first descriptor…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ec222003bd948de8f3ffbca522d328af1a8452ad <
    107e169f963920b11fa3c1bb384c077fe7330696
  - >-
    Linux >= ec222003bd948de8f3ffbca522d328af1a8452ad <
    92b45c99311ac4f3857cccee47059c4fb067fd4d
  - >-
    Linux >= ec222003bd948de8f3ffbca522d328af1a8452ad <
    b1f23df09e7dbf4c86b6908dff7efb8cb2b7d609
  - >-
    Linux >= ec222003bd948de8f3ffbca522d328af1a8452ad <
    36f81cb7d82e9614a7058da6abdf2e3a03993df1
  - >-
    Linux >= ec222003bd948de8f3ffbca522d328af1a8452ad <
    babab1b42ed68877ef669a08384becf281ad2582
  - Linux 5.4
published: '2026-05-27'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:41:01.971Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-45940'
references:
  - url: 'https://git.kernel.org/stable/c/107e169f963920b11fa3c1bb384c077fe7330696'
  - url: 'https://git.kernel.org/stable/c/92b45c99311ac4f3857cccee47059c4fb067fd4d'
  - url: 'https://git.kernel.org/stable/c/b1f23df09e7dbf4c86b6908dff7efb8cb2b7d609'
  - url: 'https://git.kernel.org/stable/c/36f81cb7d82e9614a7058da6abdf2e3a03993df1'
  - url: 'https://git.kernel.org/stable/c/babab1b42ed68877ef669a08384becf281ad2582'
tags:
  - cve.org
epss: 0.0016
epssPercentile: 0.04777
ingestedAt: '2026-10-21T12:48:53.634Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net: stmmac: fix oops when split header is enabled

For GMAC4, when split header is enabled, in some rare cases, the
hardware does not fill buf2 of the first descriptor with payload.
Thus we cannot assume buf2 is always fully filled if it is not
the last descriptor. Otherwise, the length of buf2 of the second
descriptor will be calculated wrong and cause an oops:

Unable to handle kernel paging request at virtual address ffff00019246bfc0
...
x2 : 0000000000000040 x1 : ffff00019246bfc0 x0 : ffff00009246c000
Call trace:
 dcache_inval_poc+0x28/0x58 (P)
 dma_direct_sync_single_for_cpu+0x38/0x6c
 __dma_sync_single_for_cpu+0x34/0x6c
 stmmac_napi_poll_rx+0x8f0/0xb60
 __napi_poll.constprop.0+0x30/0x144
 net_rx_action+0x160/0x274
 handle_softirqs+0x1b8/0x1fc
...

To fix this, the PL bit-field in RDES3 register is used for all
descriptors, whether it is the last descriptor or not.

## Affected

- `Linux >= ec222003bd948de8f3ffbca522d328af1a8452ad < 107e169f963920b11fa3c1bb384c077fe7330696`
- `Linux >= ec222003bd948de8f3ffbca522d328af1a8452ad < 92b45c99311ac4f3857cccee47059c4fb067fd4d`
- `Linux >= ec222003bd948de8f3ffbca522d328af1a8452ad < b1f23df09e7dbf4c86b6908dff7efb8cb2b7d609`
- `Linux >= ec222003bd948de8f3ffbca522d328af1a8452ad < 36f81cb7d82e9614a7058da6abdf2e3a03993df1`
- `Linux >= ec222003bd948de8f3ffbca522d328af1a8452ad < babab1b42ed68877ef669a08384becf281ad2582`
- `Linux 5.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.