CVE-2026-63857
Received Received - Intake

Heap Buffer Overflow in Airoha Linux Kernel Driver

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit() The transmit loop in airoha_dev_xmit() reads fragment address and length during its final iteration, when the loop index equals skb_shinfo(skb)->nr_frags, at which point the fragment data is uninitialized. While these values are never consumed, the read itself is unsafe and may trigger a page fault. Fix this by avoiding the fragment read on the last iteration. Additionally, move the skb pointer from the first to the last used packet descriptor, so that airoha_qdma_tx_napi_poll() defers freeing the skb until the final descriptor is processed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63857
EUVD
EUVD-2026-45541

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
airoha linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's airoha network driver. The issue occurs in the airoha_dev_xmit() function where it reads uninitialized fragment address and length during the final loop iteration. This read is unsafe and could cause a page fault, though the values are never actually used.

Detection Guidance

This vulnerability is specific to the Linux kernel's airoha network driver. Detection requires checking if your system uses the affected driver version. Inspect kernel logs for errors related to airoha_dev_xmit or page faults during network transmission. No direct commands are provided in the context to detect this issue.

Impact Analysis

This vulnerability could cause system instability or crashes due to page faults when the driver attempts to read uninitialized memory. It may lead to network transmission failures or kernel panics in systems using the affected airoha network driver.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it involves a low-level kernel networking issue that could cause page faults but does not expose or leak sensitive data.

Mitigation Strategies

Apply the latest kernel update that includes the fix for CVE-2026-63857. If immediate patching is not possible, disable the airoha network driver if not in use. Monitor kernel logs for page fault errors related to network transmission.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63857. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart