The Linux kernel stmmac Ethernet driver incorrectly handles DMA scatter‑gather when a received frame size exceeds the size of a single DMA buffer. The driver allocates the second buffer only when split‑header mode is active, leaving the secondary descriptor pointing at an unmapped address for regular frames. When such a frame overflows the first buffer the DMA engine writes past the valid mapping, causing the IOMMU to generate a translation fault and crashing the kernel. This is a classic buffer overrun that violates memory bounds, resulting in a local denial of service. The weakness is a violation of memory‑bounds checks in the driver’s buffer‑refill logic, allowing a DMA fault when the hardware performs scatter‑gather on oversized frames. A malicious actor may trigger the fault by injecting oversized Ethernet frames or by enabling jumbo frames on a device that has the unpatched driver, thereby forcing the DMA engine to exceed the allocated buffer.

All systems running a Linux kernel that includes the stmmac driver on ARM platforms such as GMAC4/XGMAC, particularly those compiled for IOMMU support. The issue arises on any deployment that receives Ethernet frames larger than the configured dma_buf_sz on an interface using stmmac. Specific kernel versions are not listed here, but the patch is present in recent mainline releases and distribution kernel updates. Users of older kernels or custom builds that use the stmmac driver must verify whether the driver has applied the scatter‑gather fix before deploying the hardware in a production environment.

The CVSS score of 6.5 indicates a moderate risk, and the EPSS score of < 1% indicates a very low likelihood of exploitation. The vulnerability is severe because it results in a kernel crash via an IOMMU translation fault. The defect is local to the kernel driver, but because Ethernet frames are received from the network, an attacker with access to the network or the ability to inject packets could exploit it. The risk is mitigated only by applying the fix that ensures the secondary buffer is correctly allocated and mapped for all frames. The issue is listed as a known vulnerability within the Linux kernel community, but it is not present in the CISA KEV catalog.