CVE-2026-31737

Vulnerability

In the Linux kernel's ftgmac100 network driver, the ftgmac100_alloc_rings() function allocates multiple resources (rx_skbs, tx_skbs, rxdes, txdes, rx_scratch) in stages. If an intermediate allocation fails, the function previously returned -ENOMEM directly without freeing previously allocated resources, causing a memory leak [1].

Exploitation

An attacker with local access and the ability to trigger a device open operation (e.g., by bringing the network interface up) could cause an allocation failure, leading to the leak. No-op. The vulnerability is triggered during normal driver initialization when memory is low; no special privileges beyond local access are required.

Impact

A successful exploitation results in a memory leak, which over repeated attempts could exhaust system memory, leading to denial of service. The CVSS v3 score of 5.5 (Medium) reflects the local attack vector and potential for availability impact.

Mitigation

The fix introduces staged local unwind labels that free allocated resources in reverse order before returning -ENOMEM, matching common netdev allocation cleanup style [1]. The fix has been backported to stable kernel branches [2][3][4].