ACK: [SRU][Q][PATCH 0/1] CVE-2026-31501

[Hui Wang]

Acked-by: Hui Wang <hui.wang at canonical.com>

On 6/24/26 08:27, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-31501
>
> [ Impact ]
>
> In the TI ICSSG PRUETH driver, cppi5_hdesc_get_psdata() returns a pointer into
> a CPPI descriptor. In both emac_rx_packet() and emac_rx_packet_zc(), the
> descriptor is freed via k3_cppi_desc_pool_free() before the psdata pointer is
> dereferenced by emac_rx_timestamp(), which accesses psdata[0] and psdata[1].
> This is a use-after-free that occurs on every received packet that goes through
> the timestamp path, and could lead to memory corruption or other undefined
> behavior.
>
> [ Fix ]
>
> questing: backported with AI-assisted adaptation
>
> [ Test Plan ]
>
> Boot tested.
>
> [ Where Problems Could Occur ]
>
> A regression in this change to the ti icssg-prueth networking driver could
> affect RX packet processing or hardware timestamping, potentially causing
> dropped packets or descriptor pool mismanagement on affected TI platforms.
>