CVE-2026-63857 net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit()

🗓️ 19 Jul 2026 14:04:46Reported by GoogleType

osv🔗 osv.dev👁 5 Views

Fixed airoha_dev_xmit to avoid reading uninitialized fragment address on the last iteration and defer freeing skb until the final descriptor.

Reporter	Title	Published	Views	Family All 8
CVE	CVE-2026-63857	19 Jul 202614:04	–	cve
Cvelist	CVE-2026-63857 net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit()	19 Jul 202614:04	–	cvelist
EUVD	EUVD-2026-45541	19 Jul 202614:04	–	euvd
NVD	CVE-2026-63857	19 Jul 202615:16	–	nvd
OSV	DEBIAN-CVE-2026-63857	19 Jul 202615:16	–	osv
OSV	UBUNTU-CVE-2026-63857	20 Jul 202600:00	–	osv
Positive Technologies	PT-2026-61174	19 Jul 202600:00	–	ptsecurity
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2026-63857	19 Jul 202600:00	–	nessus

Source	Link
git	www.git.kernel.org/stable/c/bde34e84edc8b5571fbde7e941e175a4293ee1eb
git	www.git.kernel.org/stable/c/d78c8ab7bd84952e053d0c622b7fc1b4ad8a19a3
git	www.git.kernel.org/stable/c/f670fa4b19ceddc6d215dda4997888ccba9bbc61
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63857.json
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-63857
git	www.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

21 Jul 2026 03:47Current

5.3Medium risk

Vulners AI Score5.3

CVSS 3.19.8

EPSS0.00155