CVE-2026-98592

In the Linux kernel, the following vulnerability has been resolved:

net: spacemit: clear TX descriptor on fragment mapping failure

emac tx mem map() writes TX DESC 0 OWN into the ring descriptor for every slot beyond old head as soon as that slot's memset()'d local copy is committed with "*tx desc addr = tx desc", i.e. before the buffers for that slot have necessarily all been mapped successfully. If emac tx map frag() then fails on a later fragment, the err free skb path calls emac free tx buf() to unmap and drop the skb, but leaves the already-written descriptor memory untouched, and tx ring->head is never advanced past old head (the "tx ring->head = head" store is skipped by the goto).

So a slot between old head and the rolled-back head can be left with TX DESC 0 OWN set and buffer addr {1,2} pointing at DMA mappings that emac free tx buf() just tore down, while software considers that slot free again. The next successful emac tx mem map() call only rebuilds old head itself; if the DMA engine auto-advances into the following descriptor once it finishes old head's packet, it will fetch that stale, already-unmapped address.

emac tx clean desc() already treats emac free tx buf() and clearing the descriptor as a pair when reclaiming completed descriptors; do the same in the mapping failure path.