CVE-2026-98803

In the Linux kernel, the following vulnerability has been resolved:

net: stmmac: fix rx Scatter-Gather support

When a received frame is larger than dma_buf_sz, the DMA scatters it

across multiple RX descriptors (rx Scatter-Gather). The secondary RX

buffer (sec_page) was only allocated and programmed when split-header

(SPH) was active, so for regular frames buffer2 was neither allocated

nor backed by a valid mapping. As soon as an incoming frame overflowed

buffer1, the DMA wrote the overflow into the unmapped secondary-buffer

address, triggering an SMMU translation fault on IOMMU-based platforms:

arm-smmu 15000000.iommu: Unhandled context fault: fsr=0x402, iova=0x00000000, fsynr=0x7f0011, cbfrsynra=0x1c90, cb=11

arm-smmu 15000000.iommu: FSR = 00000402 [Format=2 TF], SID=0x1c90

arm-smmu 15000000.iommu: FSYNR0 = 007f0011 [S1CBNDX=127 WNR PLVL=1]

Enable scatter-gather for non-SPH frames on cores that can program an

independent secondary RX buffer (GMAC4/XGMAC): allocate and mark buffer2

as valid in stmmac_init_rx_buffers() and stmmac_rx_refill(), and account

for it in the buffer length computation. Legacy cores have no set_sec_addr

op, so they keep buffer2 disabled.

Since buffer2 is handed to the DMA at page offset 0, the page pool sync

window is widened to cover both buffers in every mode: offset is set to 0

and max_len to dma_buf_sz + stmmac_rx_offset().

The FCS can straddle the buffer1/buffer2 boundary and a descriptor

boundary, so it is now stripped from the tail of the assembled frame with

pskb_trim() instead of from a single buffer, avoiding an unsigned underflow

for frames that overflow a buffer by 1..3 bytes. For single-buffer frames

the XDP program must not see the FCS, so it is removed from the XDP buffer

before the program runs.

Native XDP currently only supports single-buffer (linear) frames. An

oversized frame accepted by the MAC (jumbo enabled) is received via

buffer2; the XDP program only sees buffer1, so on a TX/REDIRECT verdict

the frame is forwarded truncated. XDP multi-buffer support to handle

this case is planned as a follow-up.

AF_XDP zero-copy RX is not covered by this change: a ZC queue still

programs buffer2 at DMA address 0 (and XGMAC has no buffer2-valid bit),

so an oversized frame overflowing buffer1 can still trigger the same

SMMU translation fault. Handling is planned as a follow-up.