Executive brief
A vulnerability in the Marvell MVPP2 network driver within the Linux kernel could allow the system to incorrectly reuse memory buffers during network packet processing. This occurs when the system fails to properly allocate new memory before passing existing data to the networking stack, potentially leading to memory corruption or system instability. In practice, this could result in service outages or unpredictable behavior on devices using this specific Marvell hardware.
Technical details
A race condition or logic error exists in the `mvpp2` driver's RX path where `mvpp2_rx_refill()` could fail after a buffer was already handed off to XDP or an skb. When this failure occurred, the driver's error path would return the buffer to the hardware Buffer Management (BM) pool even though the driver no longer exclusively owned it. This allows hardware DMA to write into memory that may have been recycled, redirected, or freed by the networking stack. The fix reorders operations to ensure the BM pool is refilled before the current buffer is handed off; if refill fails, the packet is dropped and the still-owned buffer is safely returned to the pool.
Affected products
- Linux Linux Kernel 5.7.15 to 5.8, 5.8.2 to 5.9, and others including 6.x branches prior to the fix
Timeline
- 2026-06-07: disclosed: Initial patch submitted by Til Kaiser
- 2026-06-11: patched: Patch committed to mainline kernel
- 2026-06-25: advisory: CVE-2026-53215 published
References
- https://git.kernel.org/stable/c/02e1b5c4d3b4c658b72c145427cded1bba613fc1
- https://git.kernel.org/stable/c/580f92f27cb8724bcc4be98ee89890eab524a2ae
- https://git.kernel.org/stable/c/5e8e2a9624df72fca7c736b2966b2cbf6c9c3ff6
- https://git.kernel.org/stable/c/8a2126c5afe89f8ceeb60a3afb9f075b736194cd
- https://git.kernel.org/stable/c/a03cdcedb2cbcc42551dc3e4746929e93c5352d5
- https://git.kernel.org/stable/c/a88b3293b556f4d8fba11db9a8061a6b0d3b69e6
- https://git.kernel.org/stable/c/d0c8c4fbd22d260fe28530260656c5fb3c20ce84