The stmmac driver in the Linux kernel misestimates the number of transmit descriptors required for a TSO (TCP Segmentation Offload) packet when the packet is highly fragmented. The calculation underestimates the descriptors needed, causing the driver to believe the ring buffer has sufficient free slots when it does not. As a result, subsequent writes to the descriptor ring go beyond the buffer boundary and overwrite descriptor entries still owned by the DMA engine. This out‑of‑bounds write corrupts critical kernel data structures and can destabilize the network stack, manifesting as loss of connectivity or a denial‑of‑service condition. The weakness is a classic buffer overrun (CWE‑787).

All builds of the Linux kernel that contain the buggy stmmac implementation before the patch are impacted. The stmmac driver is deployed on a wide range of network devices, including embedded routers, industrial controllers, and consumer networking gear. The vendor is Linux, and the product is the Linux kernel. Exact kernel versions are not enumerated in the data; any kernel version containing the pre‑patch stmmac code should be considered vulnerable.

The CVSS score of 7 denotes medium‑high severity. The EPSS score of < 1 % indicates a very low probability that the vulnerability is actively exploited in the wild. The CVE is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote and involves an attacker sending specially crafted, highly fragmented TSO packets to an interface driven by stmmac. There is no evidence in the data that the flaw can be leveraged for privilege escalation or remote code execution beyond potential denial of service.