---
id: CVE-2026-98571
title: 'net: stmmac: clear stale buf->page after recycling on skb build failure'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net: stmmac: clear stale buf->page after recycling on skb build failure

  In stmmac_rx(), when napi_build_skb() fails the descriptor page is
  recycled back to the page po…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= df542f669307918f054a17878ff6dd1ddbb2fe18 <
    501baaeca7d128fa0a2f6953cf5873c5b0d7cf89
  - >-
    Linux >= df542f669307918f054a17878ff6dd1ddbb2fe18 <
    298673397ea3f6f5811b84f0d9f71eac71dda2e3
  - >-
    Linux >= df542f669307918f054a17878ff6dd1ddbb2fe18 <
    0a7822e34a0bfde31b194ac3da3253e5032b44cc
  - Linux 6.14
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:18:37.195Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98571'
references:
  - url: 'https://git.kernel.org/stable/c/501baaeca7d128fa0a2f6953cf5873c5b0d7cf89'
  - url: 'https://git.kernel.org/stable/c/298673397ea3f6f5811b84f0d9f71eac71dda2e3'
  - url: 'https://git.kernel.org/stable/c/0a7822e34a0bfde31b194ac3da3253e5032b44cc'
tags:
  - cve.org
ingestedAt: '2026-10-18T15:45:12.257Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net: stmmac: clear stale buf->page after recycling on skb build failure

In stmmac_rx(), when napi_build_skb() fails the descriptor page is
recycled back to the page pool with page_pool_recycle_direct(), but
buf->page is left pointing at the recycled page, unlike every other
consumption site in the function which clears the pointer after handing
the page away.

With the stale pointer stmmac_rx_refill() skips the replacement
allocation and programs the already-recycled page back into the RX
descriptor.

Clear buf->page on the napi_build_skb() failure path to keep the buffer
lifecycle consistent with the other consumption sites.

## Affected

- `Linux >= df542f669307918f054a17878ff6dd1ddbb2fe18 < 501baaeca7d128fa0a2f6953cf5873c5b0d7cf89`
- `Linux >= df542f669307918f054a17878ff6dd1ddbb2fe18 < 298673397ea3f6f5811b84f0d9f71eac71dda2e3`
- `Linux >= df542f669307918f054a17878ff6dd1ddbb2fe18 < 0a7822e34a0bfde31b194ac3da3253e5032b44cc`
- `Linux 6.14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.