[SRU][Q][PATCH 0/1] CVE-2026-31501

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-31501

[ Impact ]

In the TI ICSSG PRUETH driver, cppi5_hdesc_get_psdata() returns a pointer into
a CPPI descriptor. In both emac_rx_packet() and emac_rx_packet_zc(), the
descriptor is freed via k3_cppi_desc_pool_free() before the psdata pointer is
dereferenced by emac_rx_timestamp(), which accesses psdata[0] and psdata[1].
This is a use-after-free that occurs on every received packet that goes through
the timestamp path, and could lead to memory corruption or other undefined
behavior.

[ Fix ]

questing: backported with AI-assisted adaptation

[ Test Plan ]

Boot tested.

[ Where Problems Could Occur ]

A regression in this change to the ti icssg-prueth networking driver could
affect RX packet processing or hardware timestamping, potentially causing
dropped packets or descriptor pool mismanagement on affected TI platforms.