CVE-2026-53217: Linux Kernel mvpp2 Driver DMA Cache Sync Vulnerability

Technical summary

The mvpp2 driver configures the RX queue to write incoming packets at dma_addr + MVPP2_SKB_HEADROOM offset. However, the DMA cache synchronization call was incorrectly starting at dma_addr (missing the headroom offset) and covering only rx_bytes + MVPP2_MH_SIZE bytes. On non-coherent DMA architectures, this leaves tail bytes of the received frame unsynchronized, allowing the CPU to read stale cache contents instead of the actual packet data written by hardware. The fix uses dma_sync_single_range_for_cpu() with the proper range offset to ensure the sync covers the Marvell header and all packet data actually transferred by the NIC.

Business impact

This vulnerability affects any Linux-based network service running on hardware with non-coherent DMA—particularly common in ARM and PowerPC systems used in embedded appliances, network gear, and some edge computing platforms. A remote attacker can send crafted packets that trigger kernel memory corruption, leading to service disruption (denial of service), information leakage from kernel memory, or privilege escalation if the packet handling path crosses privilege boundaries. Organizations operating such systems could face unexpected downtime, data exposure, or compromise of network infrastructure.

Affected systems

Linux kernel across multiple versions running on systems with non-coherent DMA subsystems. The vulnerability is present in the mvpp2 Marvell network driver used by systems with Marvell PPv2 network interfaces—commonly found in ARM-based networking appliances, routers, storage devices, and embedded Linux systems. Standard x86/x64 systems with coherent DMA are not affected.

Exploitability

No public exploit code is known, and this has not been added to the Known Exploited Vulnerabilities (KEV) catalog. However, exploitation requires only network access and the ability to send packets to an affected system—no authentication or user interaction needed. Crafting malicious packets is straightforward for an attacker with basic networking knowledge. The barrier to exploitation is low; the main constraint is having a vulnerable system with the affected driver and non-coherent DMA architecture.

Remediation

Apply the kernel patch that replaces the standard dma_sync_single_for_cpu() call with dma_sync_single_range_for_cpu(), specifying MVPP2_SKB_HEADROOM as the range offset. This ensures synchronization covers the correct memory region written by hardware. Verify the patch against the Linux kernel security advisory for your distribution or kernel version. Systems unable to update immediately should restrict network access to trusted sources and monitor for unusual packet patterns.

Patch guidance

Check your Linux distribution's security advisories for a kernel update that addresses CVE-2026-53217. The fix is a targeted change to the mvpp2 driver's DMA synchronization logic. Kernel versions and patch availability vary by distribution (RHEL, Ubuntu, Debian, etc.); consult your vendor's advisory for specific version numbers and update instructions. Test patches in a staging environment first, particularly on network-critical systems. Reboot is required after kernel update.

Detection guidance

Monitor system logs for kernel oops, panic messages, or network driver errors correlating with unusual incoming traffic patterns. Tools like tcpdump can help identify malformed packets targeting the system. Kernel-level monitoring or eBPF-based detection could flag unexpected memory access patterns in the mvpp2 driver, though signature-based detection is difficult without known exploit samples. Device-specific intrusion detection tuned to your network appliances may catch related anomalies.

Why prioritize this

HIGH severity (CVSS 8.6) with remote, unauthenticated attack surface and no user interaction required. Impact spans confidentiality (information disclosure from kernel memory), integrity (packet data corruption), and availability (potential kernel crash). While not yet in active exploitation catalogs, the ease of triggering via network packets and the memory corruption nature make this a credible threat to affected infrastructure. Prioritize patching any ARM/PowerPC-based network appliances and embedded systems in your environment.

Risk score, explained

CVSS 3.1 score of 8.6 reflects: Attack Vector = Network (AV:N), Attack Complexity = Low (AC:L), no authentication required (PR:N), no user interaction (UI:N), scope unchanged (S:U), and impacts to confidentiality (High), integrity (Low), and availability (Low). The high score is justified by the remote, easy-to-trigger nature of the vulnerability and its reach into kernel memory, though full system compromise is not guaranteed. The actual risk in your environment depends on whether you operate systems with non-coherent DMA and Marvell PPv2 hardware.

Frequently asked questions