In the Linux kernel, the stmmac network driver miscalculates the number of transmit descriptors required for a TSO packet when the packet is highly fragmented. This underestimation allows the driver to write beyond the available ring slots, corrupting the transmit descriptor list. The corruption can disrupt the network stack, potentially leading to service disruption or enabling further exploitation by compromising kernel memory integrity. This is an out-of-bounds write vulnerability (CWE-119).

The affected product is the Linux kernel stmmac driver, which is used on many network devices such as embedded routers, industrial controllers, and mobile devices. All kernel releases that include the buggy stmmac implementation are impacted; the specific affected version range is not specified in the data, so any kernel using stmmac prior to the patch must be considered vulnerable.

The CVSS score is not supplied in the available data, and EPSS is not available, making it difficult to quantify the exact risk level. The advisory indicates that the bug is exploitable only when the network interface receives highly fragmented TSO traffic, which requires the attacker to send specially crafted packets. Because the vulnerability corrupts driver state rather than directly giving code execution, the attacker’s objective would be to cause a denial of service or to position for a subsequent privilege escalation. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not been widely leveraged in the wild as of the time of this advisory.