CVE-2026-97614
Received Received - Intake

Buffer Overflow in Linux Kernel DSA Tagger

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: dsa: tag_brcm: legacy FCS: request needed tailroom The legacy FCS tagger calculates the CRC over skb->len bytes starting at skb->data. When a nonlinear skb reaches the tagger, this reads past the linear head into unrelated slab memory. The tagger appends an Ethernet FCS but does not declare that tailroom. As a result, DSA leaves NETIF_F_SG and NETIF_F_FRAGLIST enabled on the user port, and nonlinear skbs can reach the CRC calculation. Declare the required tailroom. DSA will then clear those features and the networking core will linearize skbs before the tagger runs. A KASAN-enabled dsa_loop test using this tagger reports: BUG: KASAN: slab-out-of-bounds in crc32_le Read of size 1 at addr ffff8880397086c0 by task exp/135 Call Trace: crc32_le (lib/crc/crc32-main.c:38) brcm_leg_fcs_tag_xmit (net/dsa/tag_brcm.c:343) dsa_user_xmit (net/dsa/user.c:942) dev_hard_start_xmit (net/core/dev.c:3937) __dev_queue_xmit (net/core/dev.c:4926) packet_sendmsg (net/packet/af_packet.c:3110) __sys_sendto (net/socket.c:2281) The buggy address belongs to the object at ffff888039708400 which belongs to the cache skbuff_small_head of size 704 The buggy address is located 0 bytes to the right of allocated 704-byte region [ffff888039708400, ffff8880397086c0)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97614
EUVD
EUVD-2026-86745

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves the DSA (Distributed Switch Architecture) tagger for Broadcom switches. The issue occurs when processing nonlinear network packets (skbs) where the CRC calculation reads past the intended data into unrelated memory. This happens because the tagger does not reserve enough tailroom for the FCS (Frame Check Sequence) and fails to declare this requirement. As a result, the network stack may pass nonlinear packets to the tagger, leading to out-of-bounds memory access and potential crashes or security issues.

Detection Guidance

This vulnerability may trigger KASAN errors when nonlinear skbs reach the brcm_leg_fcs_tag_xmit function. Monitor kernel logs for KASAN slab-out-of-bounds errors in crc32_le or brcm_leg_fcs_tag_xmit. Check for crashes or memory corruption in network operations involving DSA-tagged interfaces.

Impact Analysis

This vulnerability can cause system instability, crashes, or security breaches due to memory corruption. Attackers could exploit it to execute arbitrary code or cause denial-of-service conditions by sending specially crafted network packets. Systems using affected Linux kernel versions with DSA and Broadcom switch tagging are at risk.

Mitigation Strategies

Apply the Linux kernel patch that declares required tailroom for the legacy FCS tagger. This will disable NETIF_F_SG and NETIF_F_FRAGLIST on affected ports, forcing the networking core to linearize skbs before processing. Update to a kernel version containing the fix.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97614. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart