[SRU][Q][PATCH 0/1] CVE-2026-53215

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-53215

[ Impact ]

The mvpp2 network driver's RX error path returns the current descriptor buffer
to the hardware BM pool, but this is only valid while the driver still owns the
buffer. When mvpp2_rx_refill() fails after the current buffer has been handed
to XDP or attached to an skb, the buffer may have already been recycled,
redirected, queued for XDP_TX, or freed. Returning such a buffer to the BM pool
lets hardware DMA into memory that is no longer owned by the RX ring, leading
to memory corruption. This has a CVSS score of 9.8.

[ Fix ]

questing: clean cherry-pick

[ Test Plan ]

Boot tested.

[ Where Problems Could Occur ]

A regression in this fix could affect packet reception and buffer management in
the mvpp2 Ethernet driver, potentially causing packet drops, buffer pool
depletion, or memory handling errors on Marvell PPv2 network hardware.