CVE-2026-64055
Received Received - Intake

Linux Kernel GMAC RX Fragment Counter Reset Vulnerability

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Carry over frag counter The gmac_rx() NAPI poll function assembles packets in an SKB from a ring buffer. If the ring buffer gets completely emptied during a poll cycle, we exit gmac_rx(), but the packet is not yet completely assembled in the SKB, yet the fragment counter frag_nr is reset to zero on the next invocation. Solve this by making the RX fragment counter a part of the port struct, and carry it over between invocations. Reset the fragment counter only right after calling napi_gro_frags(), on error (after calling napi_free_frags()) or if stopping the port. Reset it in some place where not strictly necessary just to emphasize what is going on. This was found by Sashiko during normal patch review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64055
EUVD
EUVD-2026-45628

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
linux linux_kernel *
linux_kernel linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a network driver for Cortina Ethernet hardware. The issue occurs in the gmac_rx() function, which assembles network packets from a ring buffer during NAPI polling. If the ring buffer empties during a poll cycle, the fragment counter resets incorrectly, causing packet assembly to fail. The fix involves making the fragment counter part of the port structure and resetting it only after packet processing or on error.

Detection Guidance

This vulnerability is specific to the Linux kernel's Cortina GMAC ethernet driver and may not have direct detection commands. Monitor kernel logs for errors related to gmac_rx() or NAPI polling failures. Check for packet assembly issues in network interfaces using Cortina hardware.

Impact Analysis

This vulnerability could lead to network packet corruption or loss if the Ethernet driver fails to properly assemble packets. Users might experience connectivity issues, dropped connections, or data transmission errors on systems using the affected Cortina Ethernet hardware.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a low-level Linux kernel networking issue related to packet assembly in the ethernet driver. Compliance impacts would depend on how the affected system is used, not the vulnerability itself.

Mitigation Strategies

Update your Linux kernel to the latest patched version that includes the fix for this issue. If using a Cortina-based ethernet device, verify the driver version and apply any vendor-provided updates. Monitor network performance and logs for signs of packet corruption or assembly failures.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64055. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart