# CVE-2026-98592: net: spacemit: clear TX descriptor on fragment mapping failure

> A use-after-free vulnerability in the SpacemiT EMAC driver allows attackers to cause denial of service or potentially execute code via crafted network traffic.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 18 Oct 2026
- **Updated:** 19 Oct 2026
- **Also known as:** BELL-CVE-2026-98592, DEBIAN-CVE-2026-98592, GHSA-f5v2-jrgp-7g6f, UBUNTU-CVE-2026-98592

## What is CVE-2026-98592?

CVE-2026-98592 is an use after free vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

net: spacemit: clear TX descriptor on fragment mapping failure

emac_tx_mem_map() writes TX_DESC_0_OWN into the ring descriptor for
every slot beyond old_head as soon as that slot's memset()'d local
copy is committed with "*tx_desc_addr = tx_desc", i.e. before the
buffers for that slot have necessarily all been mapped successfully.
If emac_tx_map_frag() then fails on a later fragment, the err_free_skb
path calls emac_free_tx_buf() to unmap and drop the skb, but leaves
the already-written descriptor memory untouched, and tx_ring->head is
never advanced past old_head (the "tx_ring->head = head" store is
skipped by the goto).

So a slot between old_head and the rolled-back head can be left with
TX_DESC_0_OWN set and buffer_addr_{1,2} pointing at DMA mappings that
emac_free_tx_buf() just tore down, while software considers that slot
free again. The next successful emac_tx_mem_map() call only rebuilds
old_head itself; if the DMA engine auto-advances into the following
descriptor once it finishes old_head's packet, it will fetch that
stale, already-unmapped address.

emac_tx_clean_desc() already treats emac_free_tx_buf() and clearing
the descriptor as a pair when reclaiming completed descriptors; do
the same in the mapping failure path.

## Which versions are affected by CVE-2026-98592?


## How do I fix CVE-2026-98592?

Apply the vendor's patch.

## Is CVE-2026-98592 being exploited?

There is no known exploitation of CVE-2026-98592 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-98592 and fix it if it is affected.

What it is: CVE-2026-98592 is an use after free vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-98592 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-98592/ (Markdown: https://insights.sbomify.com/CVE-2026-98592/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-98592
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-98592
- OSV: https://osv.dev/vulnerability/CVE-2026-98592

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-98592/
Summaries are generated and may contain mistakes; the official description above is the record.