In the Linux kernel, the following vulnerability has been resolved:
netmem: prevent TX of unreadable skbs
Currently on stable trees we have support for netmem/devmem RX but not TX. It is not safe to forward/redirect an RX unreadable netmem packet into the device's TX path, as the device may call dma-mapping APIs on dma addrs that should not be passed to it.
Fix this by preventing the xmit of unreadable skbs.
Tested by configuring tc redirect:
sudo tc qdisc add dev eth1 ingress sudo tc filter add dev eth1 ingress protocol ip prio 1 flower ip_proto \ tcp src_ip 192.168.1.12 action mirred egress redirect dev eth1
Before, I see unreadable skbs in the driver's TX path passed to dma mapping APIs.
After, I don't see unreadable skbs in the driver's TX path passed to dma mapping APIs.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Redhat_linux | — | — | Jul 9, 2025 | Apr 1, 2025 |
| Suse | — | Upgrade kernel-kvmsmall-vdsoUpgrade kernel-default-vdsoUpgrade kernel-develUpgrade kernel-source-vanillaUpgrade kernel-64kb-extraUpgrade kernel-azureUpgrade kernel-default-livepatchUpgrade kernel-docs-htmlUpgrade kernel-defaultUpgrade kernel-kvmsmallUpgrade kernel-azure-extraUpgrade kernel-zfcpdumpUpgrade kernel-symsUpgrade kernel-obs-qaUpgrade kernel-64kb-develUpgrade kernel-azure-vdsoUpgrade kernel-docsUpgrade kernel-source-azureUpgrade kernel-macrosUpgrade kernel-kvmsmall-develUpgrade kernel-devel-azureUpgrade kernel-azure-develUpgrade kernel-64kbUpgrade kernel-sourceUpgrade kernel-default-develUpgrade kernel-default-extra | Dec 5, 2025 | Dec 5, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub