CVE Intelligence
Analysis AI-assisted

CVE-2026-53215: Linux kernel mvpp2 Ethernet driver: RX buffer returned to hardware pool while still in use

A fix in the mvpp2 network driver of the Linux kernel addresses a case where a receive buffer could be returned to the hardware buffer manager after the driver had already handed it to XDP or to a socket buffer. The record says this could let hardware DMA into memory the RX ring no longer owns, and the CNA rates it 9.8 (critical, CVSS 3.1). Commits fixing the issue are linked for several stable branches.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes a flaw in the mvpp2 Ethernet driver of the Linux kernel, in the receive path. If a receive buffer had already been given to XDP or attached to a socket buffer (skb), a later refill failure could lead the driver to return that buffer to the hardware buffer manager (BM) pool. The fix refills the pool before the current buffer is handed off, and if refill fails it drops the packet and returns the still-owned buffer to BM instead.

Impact

The record states that returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. The CNA scores the issue 9.8 using CVSS 3.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Reading that vector, the attack is network-reachable, needs no privileges or user interaction, and has high impact on confidentiality, integrity and availability. This reading is an inference from the vector, not a statement from the record.

Affected products and versions

The record lists the Linux Linux Kernel product with these ranges:

  • From 5.7.15 (inclusive) to 5.8 (exclusive)
  • From 5.8.2 to 5.15.210 (exclusive)
  • From 5.16 to 6.1.176 (exclusive)
  • From 6.2 to 6.6.143 (exclusive)
  • From 6.7 to 6.12.94 (exclusive)
  • From 6.13 to 6.18.36 (exclusive)
  • From 6.19 to 7.0.13 (exclusive)
  • Version 7.1-rc1 through 7.1-rc7

The record does not give fixed version numbers. Fixed kernels are identified only through the linked commits, so administrators should check the stable branch that matches their installed kernel.

Exploitation status

The record marks this CVE as not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted for this analysis, and the record does not describe public exploit code.

Remediation and mitigation

  • Update the Linux kernel to a stable release that contains the commits linked in the record, such as the commits on the kernel.org stable tree.
  • Confirm the fix with your distribution vendor, since the record does not name vendor packages or advisories.
  • The record does not describe a workaround. Disabling or altering the driver is not covered by the sources and should be evaluated with the vendor before use.

Detection guidance

  • Inventory kernel versions across systems and compare them with the affected ranges above.
  • Identify systems that use the mvpp2 driver. The record does not name hardware platforms, so this step depends on local hardware inventory.
  • Review kernel logs and NIC statistics for unusual receive errors on mvpp2 interfaces. The record does not provide specific indicators of compromise.

Limitations of the available information

  • The record has no CWE classification, no EPSS score and no SSVC data.
  • The record does not name hardware, distributions or vendor advisories.
  • The record does not describe a proof of concept or observed attacks.
  • The record gives no fixed version numbers; fix status must be read from the linked commits.
  • The original title field was empty; the title used here is written for this analysis.

Frequently asked questions

What does this Linux kernel mvpp2 flaw allow?

According to the record, returning a receive buffer that was already handed to XDP or an skb to the hardware buffer pool lets hardware DMA into memory the RX ring no longer owns. The CNA rates the issue 9.8 critical under CVSS 3.1.

Is this CVE known to be exploited?

The record marks it as not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted.

How do I fix it?

Update to a stable kernel that includes the linked commits. The record gives no fixed version numbers, so check the stable branch for your kernel and confirm with your distribution vendor.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.