Executive brief
The Cadence Gigabit Ethernet MAC driver in the Linux kernel has a memory corruption vulnerability in extended buffer descriptor mode that causes DMA mapping errors. This flaw can lead to sudden networking and storage subsystem failures, potentially disrupting business-critical services and requiring device restarts to recover.
Technical details
The vulnerability is a memory corruption issue in the macb Ethernet driver's RX DMA handling when operating in extended buffer descriptor mode. The root cause involves incorrect DMA memory mapping/unmapping logic where the driver attempts to free DMA memory that was never allocated or uses incorrect addresses, as evidenced by DMA-API debug warnings showing overlapping mappings and attempts to unmap unallocated memory regions. This manifests as network and MMC failures that are triggered by DMA activity and are sensitive to debug configuration. An attacker with the ability to trigger network traffic on an affected device can cause memory corruption and denial of service. The fix is available in updated kernel versions addressing the buffer descriptor handling logic.
Affected products
- Linux Linux kernel 5.4.0 and potentially other versions with macb driver extended buffer descriptor support
Timeline
- 2025-12-30: disclosed