CVE-2026-59346-POC

CVE-2026-59346 — VMXNET3 TSO 整数オーバーフロー VMware Workstation / Fusion vmware-vmx 内の VMXNET3 仮想 NIC の TSO セグメンテーションパスにおける 32 ビット整数オーバーフローの概念実証 PoC であり、ゲスト VM から到達可能です。 この問題は修正済みです。 この PoC は研究および防御目的のみで公開されています。ホスト側のクラッシュ SIGSEGV を引き起こすものであり、コード実行を試みるものではありません。 | ---|--- CVE| CVE-2026-59346 Writeup|...

DEBIAN-CVE-2026-98288

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TSO header length truncation stmmactsoxmit stores the protocol header length returned by stmmactsoheadersize in a u8. stmmactsovalidpacket admits headers up to 1023 bytes, so a header longer than 255 bytes wraps...

CVE-2026-98288 net: stmmac: fix TSO header length truncation

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TSO header length truncation stmmactsoxmit stores the protocol header length returned by stmmactsoheadersize in a u8. stmmactsovalidpacket admits headers up to 1023 bytes, so a header longer than 255 bytes wraps...

EUVD-2026-93216

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TSO header length truncation stmmactsoxmit stores the protocol header length returned by stmmactsoheadersize in a u8. stmmactsovalidpacket admits headers up to 1023 bytes, so a header longer than 255 bytes wraps...

CVE-2026-98288

The Linux kernel contains a vulnerability in the stmmac driver where stmmac_tso_xmit() incorrectly stores the protocol header length in a u8 variable. Because stmmac_tso_valid_packet() allows headers up to 1023 bytes, any header exceeding 255 bytes—such as a TCP over IPv6 socket with specific des...

PT-2026-106617

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TSO header length truncation stmmac tso xmit stores the protocol header length returned by stmmac tso header size in a u8. stmmac tso valid packet admits headers up to 1023 bytes, so a header longer than 255 byte...

CVE-2026-97953

A flaw was found in the Linux kernel's stmmac network driver. An attacker can cause a Denial of Service DoS by transmitting highly fragmented network packets that use TCP Segmentation Offload TSO. Due to an improper calculation of required transmit descriptors, the driver writes past available...

SUSE CVE-2026-97953

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TX descriptor availability check for TSO traffic stmmactsoxmit estimates the number of free TX descriptors required by a TSO skb as: skb-len - protohdrlen / TSOMAXBUFFSIZE + 1 which assumes the payload is split...

DEBIAN-CVE-2026-97953

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TX descriptor availability check for TSO traffic stmmactsoxmit estimates the number of free TX descriptors required by a TSO skb as: skb-len - protohdrlen / TSOMAXBUFFSIZE + 1 which assumes the payload is split...

CVE-2026-97953

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TX descriptor availability check for TSO traffic stmmactsoxmit estimates the number of free TX descriptors required by a TSO skb as: skb-len - protohdrlen / TSOMAXBUFFSIZE + 1 which assumes the payload is split...

AZL-104517 CVE-2026-97953 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TX descriptor availability check for TSO traffic stmmactsoxmit estimates the number of free TX descriptors required by a TSO skb as: skb-len - protohdrlen / TSOMAXBUFFSIZE + 1 which assumes the payload is split...

CVE-2026-97953 net: stmmac: fix TX descriptor availability check for TSO traffic

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TX descriptor availability check for TSO traffic stmmactsoxmit estimates the number of free TX descriptors required by a TSO skb as: skb-len - protohdrlen / TSOMAXBUFFSIZE + 1 which assumes the payload is split...

EUVD-2026-86807

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TX descriptor availability check for TSO traffic stmmactsoxmit estimates the number of free TX descriptors required by a TSO skb as: skb-len - protohdrlen / TSOMAXBUFFSIZE + 1 which assumes the payload is split...

CVE-2026-97953 net: stmmac: fix TX descriptor availability check for TSO traffic

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TX descriptor availability check for TSO traffic stmmactsoxmit estimates the number of free TX descriptors required by a TSO skb as: skb-len - protohdrlen / TSOMAXBUFFSIZE + 1 which assumes the payload is split...

CVE-2026-97953

A vulnerability exists in the Linux kernel 's stmmac driver related to the TX descriptor availability check for TSO traffic . The stmmac_tso_xmit() function incorrectly estimates the required free TX descriptors by assuming the payload is split into TSO_MAX_BUFF_SIZE chunks. This logic underestim...

CVE-2026-97953

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TX descriptor availability check for TSO traffic stmmactsoxmit estimates the number of free TX descriptors required by a TSO skb as: skb-len - protohdrlen / TSOMAXBUFFSIZE + 1 which assumes the payload is split...

CVE-2026-97953: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TX descriptor availability check for TSO traffic stmmactsoxmit estimates the number of free TX descriptors required by a TSO skb as: skb-len - protohdrlen / TSOMAXBUFFSIZE + 1 which assumes the payload is split...

PT-2026-98793

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix dma mapping leak in stmmac tso xmit In stmmac tso xmit, if the DMA mapping of an skb fragment fails, the frame is dropped but the DMA mappings already created for the linear part and for the fragments mapped befo...

PT-2026-98617

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TX descriptor availability check for TSO traffic stmmac tso xmit estimates the number of free TX descriptors required by a TSO skb as: skb-len - proto hdr len / TSO MAX BUFF SIZE + 1 which assumes the payload is...

Linux Distros Unpatched Vulnerability : CVE-2026-97953

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: stmmac: fix TX descriptor availability check for TSO traffic stmmactsoxmit estimates the number of free TX descriptors required by a TSO skb as: skb-len -...