DEBIAN-CVE-2026-31649

In the Linux kernel, the following vulnerability has been resolved:  net: stmmac: fix integer underflow in chain mode  The jumbofrm() chain-mode implementation unconditionally computes      len = nopagedlen - bmax;  where nopagedlen = skbheadlen(skb) (linear bytes only) and bmax is BUFSIZE8KiB or BUFSIZE2KiB.  However, the caller stmmacxmit() decides to invoke jumbofrm() based on skb->len (total length including page fragments):      isjumbo = stmmacisjumbofrm(priv, skb->len, enhdesc);  When a packet has a small linear portion (nopagedlen <= bmax) but a large total length due to page fragments (skb->len > bmax), the subtraction wraps as an unsigned integer, producing a huge len value (~0xFFFFxxxx).  This causes the while (len != 0) loop to execute hundreds of thousands of iterations, passing skb->data + bmax * i pointers far beyond the skb buffer to dmamapsingle().  On IOMMU-less SoCs (the typical deployment for stmmac), this maps arbitrary kernel memory to the DMA engine, constituting a kernel memory disclosure and potential memory corruption from hardware.  Fix this by introducing a buflen local variable clamped to min(nopagedlen, bmax).  Computing len = nopagedlen - buflen is then always safe: it is zero when the linear portion fits within a single descriptor, causing the while (len != 0) loop to be skipped naturally, and the fragment loop in stmmac_xmit() handles page fragments afterward.