Skip to content
OpenAdvisories
Unscored CVE-2026-98105 EUVD-2026-86936GHSA-f226-mgwm-5x89

net: ethernet: oa_tc6: Improve the error recovery

Published Sep 25, 2026 · Updated Oct 19, 2026 · Assigned by Linux

Vendor: Linux Product: Linux Package: linux Package: linux Package: linux-6.12 Package: linux-allwinner-5.19 Package: linux-aws Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.13 Package: linux-aws-5.19 Package: linux-aws-5.3 Package: linux-aws-5.8 Package: linux-aws-6.14 Package: linux-aws-6.17 Package: linux-aws-6.2 Package: linux-aws-6.5 Package: linux-aws-7.0 Package: linux-azure Package: linux-azure-5.11 Package: linux-azure-5.13 Package: linux-azure-5.19 Package: linux-azure-5.3 Package: linux-azure-5.8 Package: linux-azure-6.11 Package: linux-azure-6.14 Package: linux-azure-6.17 Package: linux-azure-6.2 Package: linux-azure-6.5 Package: linux-azure-7.0 Package: linux-azure-edge Package: linux-azure-fde Package: linux-azure-fde-5.19 Package: linux-azure-fde-6.14 Package: linux-azure-fde-6.17 Package: linux-azure-fde-6.2 Package: linux-azure-fde-7.0 Package: linux-azure-nvidia-6.14 Package: linux-gcp Package: linux-gcp-5.11 Package: linux-gcp-5.13 Package: linux-gcp-5.19 Package: linux-gcp-5.3 Package: linux-gcp-5.8 Package: linux-gcp-6.11 Package: linux-gcp-6.14 Package: linux-gcp-6.17 Package: linux-gcp-6.2 Package: linux-gcp-6.5 Package: linux-gcp-7.0 Package: linux-gke Package: linux-gke-4.15 Package: linux-gke-5.15 Package: linux-gke-5.4 Package: linux-gkeop Package: linux-gkeop-5.15 Package: linux-gkeop-5.4 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.13 Package: linux-hwe-5.19 Package: linux-hwe-5.8 Package: linux-hwe-6.11 Package: linux-hwe-6.14 Package: linux-hwe-6.17 Package: linux-hwe-6.2 Package: linux-hwe-6.5 Package: linux-hwe-7.0 Package: linux-hwe-edge Package: linux-ibm Package: linux-intel-5.13 Package: linux-intel-iot-realtime Package: linux-lowlatency-hwe-5.19 Package: linux-lowlatency-hwe-6.11 Package: linux-lowlatency-hwe-6.2 Package: linux-lowlatency-hwe-6.5 Package: linux-nvidia Package: linux-nvidia-6.11 Package: linux-nvidia-6.17 Package: linux-nvidia-6.2 Package: linux-nvidia-6.5 Package: linux-nvidia-7.0 Package: linux-nvidia-bos Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.14 Package: linux-oem-5.17 Package: linux-oem-5.6 Package: linux-oem-6.0 Package: linux-oem-6.1 Package: linux-oem-6.11 Package: linux-oem-6.14 Package: linux-oem-6.17 Package: linux-oem-6.5 Package: linux-oem-6.8 Package: linux-oem-7.0 Package: linux-oracle Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.13 Package: linux-oracle-5.3 Package: linux-oracle-5.8 Package: linux-oracle-6.14 Package: linux-oracle-6.17 Package: linux-oracle-6.5 Package: linux-oracle-7.0 Package: linux-raspi Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-realtime-6.14 Package: linux-realtime-6.17 Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.19 Package: linux-riscv-5.8 Package: linux-riscv-6.14 Package: linux-riscv-6.17 Package: linux-riscv-6.5 Package: linux-riscv-7.0 Package: linux-starfive-5.19 Package: linux-starfive-6.2 Package: linux-starfive-6.5 Package: linux-vmware Platform: Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

In the Linux kernel, the following vulnerability has been resolved:

net: ethernet: oa_tc6: Improve the error recovery

When oversubscribed traffic causes lot of buffer overflow errors,
probably due to loss of data chunks, driver fails to find a
data chunk with end_valid bit set, before it runs out of sk buffer
space. As a result, assert is seen during skb_put.

Now, check is made if skb buffer has enough tailroom for the
incoming data before accepting. If there is no room, current
frame is abandoned and it will start looking for a data chunk
with start_valid bit, that is a new frame.

SK buffer allocation error is considered as recoverable error.

rx_buf_overflow flag is too specific and no longer the only
condition this flag is used for. Therefore it is renamed as
wait_until_start_valid. This is more appropriate as this flag
is used to look for the next data chunk with SV bit set, after
failures like buffer overflow, buffer allocation failure, skb pointer
validity besides buffer overflow error.

Not writing to status0 if it reads 0.

Affected products

VendorProductAffectedFixed
Linux Linux 6.12 6.12.111

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 linux 7.2.7-1 —
Debian 13 linux 6.12.111-1 —
Debian 12 linux-6.12 6.12.111-1~deb12u1 —
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS linux 7.0.0-42.42 USN-8959-1
Ubuntu 26.04 LTS linux-aws 7.0.0-1016.17 USN-8959-1
Ubuntu 26.04 LTS linux-azure 7.0.0-1020.21 USN-9019-1
Ubuntu 26.04 LTS linux-azure-fde 7.0.0-1019.19 USN-9020-1
Ubuntu 26.04 LTS linux-gcp 7.0.0-1016.18 USN-8959-1
Ubuntu 26.04 LTS linux-gke 7.0.0-1010.11 USN-9020-1
Ubuntu 26.04 LTS linux-ibm +1 7.0.0-1017.17 USN-8960-1, USN-8959-1
Ubuntu 26.04 LTS linux-nvidia +1 No fix yet —
Ubuntu 26.04 LTS linux-oracle 7.0.0-1015.16 USN-8959-1
Ubuntu 26.04 LTS linux-raspi 7.0.0-1023.23 USN-9021-1
Ubuntu 26.04 LTS linux-realtime 7.0.0-43.43.1 USN-9020-1
Ubuntu 26.04 LTS linux-riscv 7.0.0-42.42.1 —
Ubuntu 24.04 LTS linux-aws-7.0 7.0.0-1017.18~24.04.1 USN-9020-1
Ubuntu 24.04 LTS linux-azure-fde-7.0 7.0.0-1019.19~24.04.1 USN-9020-1
Ubuntu 24.04 LTS linux-gcp-7.0 7.0.0-1017.19~24.04.1 USN-9020-1
Ubuntu 24.04 LTS linux-hwe-7.0 7.0.0-42.42~24.04.1 USN-8959-1
Ubuntu 24.04 LTS linux-oracle-7.0 7.0.0-1016.18~24.04.1 USN-9020-1
Ubuntu 24.04 LTS linux-riscv +29 No fix yet —
Ubuntu 24.04 LTS linux-riscv-7.0 7.0.0-42.42.1~24.04.1 —
Ubuntu 22.04 LTS linux-riscv +32 No fix yet —
Ubuntu 20.04 LTS linux-gke +28 No fix yet —
Ubuntu 18.04 LTS linux-gcp +14 No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS linux-hwe-edge No fix yet —
Ubuntu Pro Realtime 24.04 LTS linux-realtime-6.14 +1 No fix yet —
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed kernel-source 7.2.9-1.1 openSUSE-SU-2026:12074-1

Advisories 7

References