Jon Hunter

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 6.6.74 **Description** The issue is related to the TSO DMA API usage in the Linux kernel, specifically in the `stmmac` driver. The problem arises when the assignment of `tx skbuff dma[]` members is moved later in `stmmac tso xmit()`, causing the DMA cookie passed to `dma unmap single()` to be different from the value returned by `dma map single()`. This results in errors such as "Tx DMA map failed" and "device driver tries to free DMA memory it has not allocated". The issue is resolved by maintaining the original DMA cookie and using `tso des` to pass the offset DMA cookie to `stmmac tso allocator()`. **Recommendations** For Linux kernel versions prior to 6.6.74, update to version 6.6.74 or later to resolve the issue. As a temporary workaround, consider disabling the `stmmac` driver or restricting its use until a patch is available. Avoid using the `dma unmap single()` function with the affected `stmmac` driver until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A long-standing issue in the Synopsys DWC Ethernet driver for Tegra194 has been identified, where random system crashes occur when the split header feature is enabled in the stmmac driver. The problem arises when a larger than expected buffer length is received, causing the calculation of the total buffer length to overflow, resulting in a kernel crash. The root cause of the larger buffer length is unclear, but feedback from the NVIDIA design team indicates that the split header feature is not supported for Tegra194. **Recommendations** Disable split header support for Tegra194 to prevent random system crashes from occurring.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to the hwmon component of the Linux kernel, which can lead to a NULL pointer dereference when attempting to register a sensor with a thermal zone. This may cause the system to crash. The exact call sequence involves `hwmon notify event()` calling `hwmon thermal notify()`, which then calls `thermal zone device update()` and `update temperature()`, resulting in a call to `mutex lock()`. The hwmon core needs to handle errors returned from `devm thermal zone of sensor register()` to prevent such crashes. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.