CVE-2026-53215

In the Linux kernel, the following vulnerability has been resolved:

net: mvpp2: refill RX buffers before XDP or skb use

The RX error path returns the current descriptor buffer to the hardware

BM pool. That is only valid while the driver still owns the buffer.

mvpp2rxrefill() can fail after the current buffer has been handed to

XDP or attached to an skb. In those cases mvpp2runxdp() may have

recycled, redirected, or queued the page for XDP_TX, and an skb free also

retires the data buffer. Returning such a buffer to BM lets hardware DMA

into memory that is no longer owned by the RX ring.

Refill the BM pool before handing the current buffer to XDP or to the

skb. If the allocation fails there, drop the packet and return the

still-owned current buffer to BM, preserving the pool depth. Once the

refill succeeds, later local drops retire/free the current buffer instead

of returning it to BM.