---
id: CVE-2026-97953
title: "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: fix TX descriptor availability check for TSO traffic\n\nstmmac_tso_xmit() estimates the number of free TX descriptors required by\na TSO skb as:\n\n\t(skb->len -…"
summary: "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: fix TX descriptor availability check for TSO traffic\n\nstmmac_tso_xmit() estimates the number of free TX descriptors required by\na TSO skb as:\n\n\t(skb->len -…"
severity: high
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f748be531d7012c456b97f66091d86b3675c5fef <
    ffa6d2481bc1c87f822ecd626561484e4ee24cef
  - >-
    Linux >= f748be531d7012c456b97f66091d86b3675c5fef <
    c28175220f808c867d5618de8ecc6dbcc815c773
  - >-
    Linux >= f748be531d7012c456b97f66091d86b3675c5fef <
    65820fc743eae322f7f94f6a64d07861211d4b21
  - >-
    Linux >= f748be531d7012c456b97f66091d86b3675c5fef <
    5e38d732ec67a5b1f9a56e6c73add480c4b6030a
  - Linux 4.7
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T11:17:22.930'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97953'
references:
  - url: 'https://git.kernel.org/stable/c/5e38d732ec67a5b1f9a56e6c73add480c4b6030a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/65820fc743eae322f7f94f6a64d07861211d4b21'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c28175220f808c867d5618de8ecc6dbcc815c773'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ffa6d2481bc1c87f822ecd626561484e4ee24cef'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-25T11:06:38.877Z'
cvss: 7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H'
cvssSource: cna
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net: stmmac: fix TX descriptor availability check for TSO traffic

stmmac_tso_xmit() estimates the number of free TX descriptors required by
a TSO skb as:

	(skb->len - proto_hdr_len) / TSO_MAX_BUFF_SIZE + 1

which assumes the payload is split into TSO_MAX_BUFF_SIZE chunks. This
underestimates the descriptors actually consumed by stmmac_tso_allocator(),
since each fragment is mapped individually and so it needs at least one
descriptor regardless of its size. Moreover, one descriptor is used for
the L2/L3/L4 headers and, when the MSS changes, one more is consumed for
the MSS context descriptor.
For a highly fragmented TSO skb the check can therefore pass even when the
ring has too few free slots. stmmac_tso_allocator() then writes past the
available descriptors, overwriting descriptors still owned by the DMA
engine, corrupting the TX ring.
Add stmmac_tso_get_num_desc() to compute the exact number of descriptors
needed for the header, the linear payload and each fragment, plus the MSS
context descriptor when required, and use it in the availability check.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.