CVE-2026-63857

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the airoha dev xmit() function where the transmit loop reads fragment address and length during its final iteration. This occurs when the loop index equals skb shinfo(skb)->nr frags, resulting in the read of uninitialized fragment data. Although these values are not consumed, the operation is unsafe and can trigger a page fault. Additionally, the skb pointer is moved from the first to the last used packet descriptor to ensure airoha qdma tx napi poll() defers freeing the skb until the final descriptor is processed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.