CVE-2026-98592

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: spacemit: clear TX descriptor on fragment mapping failure

emac_tx_mem_map() writes TX_DESC_0_OWN into the ring descriptor for

every slot beyond old_head as soon as that slot's memset()'d local

copy is committed with "*tx_desc_addr = tx_desc", i.e. before the

buffers for that slot have necessarily all been mapped successfully.

If emac_tx_map_frag() then fails on a later fragment, the err_free_skb

path calls emac_free_tx_buf() to unmap and drop the skb, but leaves

the already-written descriptor memory untouched, and tx_ring->head is

never advanced past old_head (the "tx_ring->head = head" store is

skipped by the goto).

So a slot between old_head and the rolled-back head can be left with

TX_DESC_0_OWN set and buffer_addr_{1,2} pointing at DMA mappings that

emac_free_tx_buf() just tore down, while software considers that slot

free again. The next successful emac_tx_mem_map() call only rebuilds

old_head itself; if t

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References