Executive brief
A vulnerability was identified in the Linux kernel's Cortina Gemini Ethernet driver where network packets could be incorrectly processed. When the system's internal buffer emptied before a multi-part packet was fully assembled, the driver would lose track of the packet's progress, potentially leading to data corruption or network instability. This issue affects systems using specific Cortina Gemini network hardware.
Technical details
A vulnerability in the `gmac_rx()` NAPI poll function of the Cortina Gemini Ethernet driver (`drivers/net/ethernet/cortina/gemini.c`) caused the fragment counter (`frag_nr`) to be reset to zero between invocations. If a multi-fragment packet was partially assembled in a Socket Buffer (SKB) but the ring buffer became empty before completion, the subsequent poll cycle would restart the fragment count at zero for the same SKB. This root cause leads to incorrect packet reassembly. The fix moves the fragment counter into the `gemini_ethernet_port` structure to ensure state is preserved across poll cycles. The vulnerability is reachable via network traffic on systems utilizing this specific hardware driver.
Affected products
- Linux Linux Kernel 4.16 to 6.14
Timeline
- 2026-05-09: other: Patch authored
- 2026-07-19: advisory: CVE-2026-64055 published
References
- https://git.kernel.org/stable/c/46806096f35b8d3dfa2f321ddd77f597edcdb85f
- https://git.kernel.org/stable/c/7123cf481e21b54eb6adc4cb0d8dc2876aeaee41
- https://git.kernel.org/stable/c/75105fcf73f1ce7d9f769aaefec6e6d6645d5ac0
- https://git.kernel.org/stable/c/78cf08b3be47c28f07008a76c932bad7cdffa9d8
- https://git.kernel.org/stable/c/7af1fabdee744b7995fe01b30b77dfc397657cb5
- https://git.kernel.org/stable/c/c373b34877afea61c89e0dd2e38948c624249b9b
- https://git.kernel.org/stable/c/df31e3b64455293df1ea89c7da7d5c9bfbcdd253