CVE-2026-63857

In the Linux kernel, the following vulnerability has been resolved:

net: airoha: Do not read uninitialized fragment address in airohadevxmit()

The transmit loop in airohadevxmit() reads fragment address and length during its final iteration, when the loop index equals skbshinfo(skb)->nrfrags, at which point the fragment data is uninitialized. While these values are never consumed, the read itself is unsafe and may trigger a page fault. Fix this by avoiding the fragment read on the last iteration. Additionally, move the skb pointer from the first to the last used packet descriptor, so that airohaqdmatxnapipoll() defers freeing the skb until the final descriptor is processed.