CVE-2026-63857 net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit()
A Linux kernel driver bug reads uninitialized memory, potentially causing a page fault and system crash.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-63857?
CVE-2026-63857 is a critical vulnerability in Linux, published on 19 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit()
The transmit loop in airoha_dev_xmit() reads fragment address and length during its final iteration, when the loop index equals skb_shinfo(skb)->nr_frags, at which point the fragment data is uninitialized. While these values are never consumed, the read itself is unsafe and may trigger a page fault. Fix this by avoiding the fragment read on the last iteration. Additionally, move the skb pointer from the first to the last used packet descriptor, so that airoha_qdma_tx_napi_poll() defers freeing the skb until the final descriptor is processed.
Which versions are affected by CVE-2026-63857?
How do I fix CVE-2026-63857?
Apply the vendor's patch.
Is CVE-2026-63857 being exploited?
There is no known exploitation of CVE-2026-63857 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-63857, DEBIAN-CVE-2026-63857, GHSA-93j7-q4pr-7pmf, ROOT-OS-DEBIAN-13-CVE-2026-63857, UBUNTU-CVE-2026-63857.