CVE-2026-63857

In the Linux kernel, the following vulnerability has been resolved:

net: airoha: Do not read uninitialized fragment address in airohadevxmit()

The transmit loop in airohadevxmit() reads fragment address and length

during its final iteration, when the loop index equals

skbshinfo(skb)->nrfrags, at which point the fragment data is

uninitialized. While these values are never consumed, the read itself is

unsafe and may trigger a page fault. Fix this by avoiding the fragment

read on the last iteration.

Additionally, move the skb pointer from the first to the last used packet

descriptor, so that airohaqdmatxnapipoll() defers freeing the skb

until the final descriptor is processed.