CVE-2026-63857
Last modified
CVE-2026-63857 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit() The transmit loop in airoha_dev_xmit() reads fragment address and length during its final iteration, when the loop index equals skb_shinfo(skb)->nr_frags, at which point the fragment data is uninitialized. While these values are never consumed, the read itself is unsafe and may trigger a page fault. EPSS estimates a 0.35% chance of exploitation in the next 30 days.
Description
In the Linux kernel, the following vulnerability has been resolved: net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit() The transmit loop in airoha_dev_xmit() reads fragment address and length during its final iteration, when the loop index equals skb_shinfo(skb)->nr_frags, at which point the fragment data is uninitialized. While these values are never consumed, the read itself is unsafe and may trigger a page fault. Fix this by avoiding the fragment read on the last iteration. Additionally, move the skb pointer from the first to the last used packet descriptor, so that airoha_qdma_tx_napi_poll() defers freeing the skb until the final descriptor is processed.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | >= 23020f04932701d5c8363e60756f12b43b8ed752, < f670fa4b19ceddc6d215dda4997888ccba9bbc61; >= 23020f04932701d5c8363e60756f12b43b8ed752, < d78c8ab7bd84952e053d0c622b7fc1b4ad8a19a3; >= 23020f04932701d5c8363e60756f12b43b8ed752, < bde34e84edc8b5571fbde7e941e175a4293ee1eb |
| Linux | Linux | 6.11 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-63857?
How severe is CVE-2026-63857?
How do I fix CVE-2026-63857?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-63851In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2026-63852In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2026-63853In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2026-63854In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2026-63855In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2026-63856In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2026-63858In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2026-63859In the Linux kernel, the following vulnerability has been re…
- CVE-2026-6386In order to apply a particular protection key to an address …6.2
- CVE-2026-63860In the Linux kernel, the following vulnerability has been re…8.4
- CVE-2026-63861In the Linux kernel, the following vulnerability has been re…
- CVE-2026-63862In the Linux kernel, the following vulnerability has been re…
Are you affected by CVE-2026-63857?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST