CVE-2026-97614 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel configurations and DSA deployments should assess exposure and prioritize verification of kernel versions and configurations. This includes operators managing Linux-based systems, platform administrators overseeing DSA deployments, vulnerability management teams evaluating potential impacts, and security teams reviewing configurations and monitoring for potential slab-out-of-bounds reads in the Linux kernel.

Why it matters

The Linux kernel vulnerability in net: dsa: tag_brcm: legacy FCS could lead to slab-out-of-bounds reads when handling nonlinear skbs. Defenders should prioritize verifying Linux kernel versions and configurations, particularly in systems where DSA is used.

• Potential slab-out-of-bounds reads in the Linux kernel.
• Nonlinear skbs can reach the CRC calculation, causing out-of-bounds reads.
• Verification of Linux kernel versions and configurations is necessary.
• DSA configurations need review and update to prevent exploitation.

Technical summary

The Linux kernel vulnerability in net: dsa: tag_brcm: legacy FCS could lead to slab-out-of-bounds reads when handling nonlinear skbs. The tagger calculates the CRC over skb->len bytes starting at skb->data, potentially reading past the linear head into unrelated slab memory. The required tailroom is not declared, leading DSA to leave NETIF_F_SG and NETIF_F_FRAGLIST enabled on the user port. This issue arises because the tagger appends an Ethernet FCS but does not declare that tailroom, allowing nonlinear skbs to reach the CRC calculation, causing out-of-bounds reads. Defenders should prioritize verifying Linux kernel versions and configurations to ensure they are not vulnerable to this issue, particularly in

Defensive priority

Defenders should prioritize verifying the Linux kernel versions and configurations to ensure they are not vulnerable to this issue, particularly in systems where DSA is used.

Recommended defensive actions

• Verify Linux kernel versions and configurations to ensure they are not vulnerable to this issue.
• Review and update DSA configurations to prevent nonlinear skbs from reaching the CRC calculation.
• Monitor for potential slab-out-of-bounds reads in the Linux kernel.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Evidence notes

The vulnerability was discovered through a KASAN-enabled dsa_loop test, which reported a slab-out-of-bounds read in crc32_le. The call trace indicates that the issue occurs in the brcm_leg_fcs_tag_xmit function.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.