In the Linux kernel, the following vulnerability has been resolved:

net: ethernet: cortina: Carry over frag counter

The gmac_rx() NAPI poll function assembles packets in an
SKB from a ring buffer.

If the ring buffer gets completely emptied during a poll cycle,
we exit gmac_rx(), but the packet is not yet completely
assembled in the SKB, yet the fragment counter frag_nr is
reset to zero on the next invocation.

Solve this by making the RX fragment counter a part of the
port struct, and carry it over between invocations.

Reset the fragment counter only right after calling
napi_gro_frags(), on error (after calling napi_free_frags())
or if stopping the port.

Reset it in some place where not strictly necessary just to
emphasize what is going on.

This was found by Sashiko during normal patch review.

https://git.kernel.org/stable/c/46806096f35b8d3dfa2f321ddd77f597edcdb85f

https://git.kernel.org/stable/c/7123cf481e21b54eb6adc4cb0d8dc2876aeaee41

https://git.kernel.org/stable/c/75105fcf73f1ce7d9f769aaefec6e6d6645d5ac0

https://git.kernel.org/stable/c/78cf08b3be47c28f07008a76c932bad7cdffa9d8

https://git.kernel.org/stable/c/7af1fabdee744b7995fe01b30b77dfc397657cb5

https://git.kernel.org/stable/c/c373b34877afea61c89e0dd2e38948c624249b9b

https://git.kernel.org/stable/c/df31e3b64455293df1ea89c7da7d5c9bfbcdd253

https://git.kernel.org/stable/c/ebd8ec2b309e3a447851b456ccaf8fb39f3661e7

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/cortina/gemini.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88","lessThan":"df31e3b64455293df1ea89c7da7d5c9bfbcdd253","versionType":"git","status":"affected"},{"version":"4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88","lessThan":"7af1fabdee744b7995fe01b30b77dfc397657cb5","versionType":"git","status":"affected"},{"version":"4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88","lessThan":"75105fcf73f1ce7d9f769aaefec6e6d6645d5ac0","versionType":"git","status":"affected"},{"version":"4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88","lessThan":"78cf08b3be47c28f07008a76c932bad7cdffa9d8","versionType":"git","status":"affected"},{"version":"4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88","lessThan":"7123cf481e21b54eb6adc4cb0d8dc2876aeaee41","versionType":"git","status":"affected"},{"version":"4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88","lessThan":"c373b34877afea61c89e0dd2e38948c624249b9b","versionType":"git","status":"affected"},{"version":"4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88","lessThan":"46806096f35b8d3dfa2f321ddd77f597edcdb85f","versionType":"git","status":"affected"},{"version":"4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88","lessThan":"ebd8ec2b309e3a447851b456ccaf8fb39f3661e7","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/cortina/gemini.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.16","status":"affected"},{"version":"0","lessThan":"4.16","versionType":"semver","status":"unaffected"},{"version":"5.10.258","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.209","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.175","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.142","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.92","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.34","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.0.11","lessThanOrEqual":"7.0.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]