Critical 9.8Published Jul 19, 2026

CVE-2026-64055net: ethernet: cortina: Carry over frag counter

Updated under an hour ago (Oct 26, 2026, 3:50 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Carry over frag counter The gmac_rx() NAPI poll function assembles packets in an SKB from a ring buffer. If the ring buffer gets completely emptied during a poll cycle, we exit gmac_rx(), but the packet is not yet completely assembled in the SKB, yet the fragment counter frag_nr is reset to zero on the next invocation. Solve this by making the RX fragment counter a part of the port struct, and carry it over between invocations. Reset the fragment counter only right after calling napi_gro_frags(), on error (after calling napi_free_frags()) or if stopping the port. Reset it in some place where not strictly necessary just to emphasize what is going on. This was found by Sashiko during normal patch review.

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88 before df31e3b64455293df1ea89c7da7d5c9bfbcdd253; from 4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88 before 7af1fabdee744b7995fe01b30b77dfc397657cb5; from 4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88 before 75105fcf73f1ce7d9f769aaefec6e6d6645d5ac0; from 4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88 before 78cf08b3be47c28f07008a76c932bad7cdffa9d8; from 4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88 before 7123cf481e21b54eb6adc4cb0d8dc2876aeaee41; from 4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88 before c373b34877afea61c89e0dd2e38948c624249b9b; from 4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88 before 46806096f35b8d3dfa2f321ddd77f597edcdb85f; from 4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88 before ebd8ec2b309e3a447851b456ccaf8fb39f3661e7	CNA record
linux linux_kernel linux:linux_kernel	from 4.16 before 5.10.258; from 5.11 before 5.15.209; from 5.16 before 6.1.175; from 6.2 before 6.6.142; from 6.7 before 6.12.92; from 6.13 before 6.18.34; from 6.19 before 7.0.11; 7.1; and 2 more ranges	NVD

References

References

https://git.kernel.org/stable/c/df31e3b64455293df1ea89c7da7d5c9bfbcdd253	patch
https://git.kernel.org/stable/c/7af1fabdee744b7995fe01b30b77dfc397657cb5	patch
https://git.kernel.org/stable/c/75105fcf73f1ce7d9f769aaefec6e6d6645d5ac0	patch
https://git.kernel.org/stable/c/78cf08b3be47c28f07008a76c932bad7cdffa9d8	patch
https://git.kernel.org/stable/c/7123cf481e21b54eb6adc4cb0d8dc2876aeaee41	patch
https://git.kernel.org/stable/c/c373b34877afea61c89e0dd2e38948c624249b9b	patch
https://git.kernel.org/stable/c/46806096f35b8d3dfa2f321ddd77f597edcdb85f	patch
https://git.kernel.org/stable/c/ebd8ec2b309e3a447851b456ccaf8fb39f3661e7	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.