CVE-2026-53215: net: mvpp2: refill RX buffers before XDP or skb use

Synopsis

A use-after-free vulnerability exists in the Linux kernel's mvpp2 network driver, reachable over the network without any authentication. The flaw allows hardware DMA to write into memory that the driver no longer owns, because the RX error path incorrectly returns a buffer to the BM pool after that buffer has already been handed to XDP or attached to an skb. Successful exploitation gives an attacker the ability to read arbitrary memory, overwrite arbitrary memory, and crash the affected system. Patched-image rebuilds at the fix versions (5.8, 5.15.210, and the upstream commit references) are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable code path is reachable over the network; an attacker must be able to send crafted packets to the affected interface exposed by the mvpp2 driver.

• AuthenticationNot required

  No account or credentials are required; the exploit is triggered by unauthenticated network traffic.

• Victim interactionNot required

  No user or administrator action is needed; exploitation is fully remote and passive from the victim's perspective.

• Attack complexityDetail

  Attack complexity is low; the exploit is reliable and requires no special conditions, race wins, or knowledge of memory layout beyond reaching the vulnerable network interface.

Blast Radius

• An attacker triggers hardware DMA writes into freed memory pages, enabling arbitrary memory corruption anywhere in the kernel address space.
• Kernel memory containing credentials, session tokens, or sensitive process data can be read by influencing which freed pages are reused and inspected.
• Corrupted kernel data structures cause an unrecoverable kernel panic, crashing the host and any containers or workloads running on it.
• Persistent memory corruption can be used to overwrite kernel function pointers, providing a path to full kernel code execution.