Executive brief
A vulnerability in the Linux kernel's stmmac network driver can cause a system crash when processing specific high-speed network traffic. This occurs when the system attempts to use 'zero-copy' data transfer methods without correctly identifying the memory type, leading to a kernel panic. An exploit would result in a complete loss of system availability, potentially disrupting industrial operations or server services.
Technical details
A flaw exists in the stmmac network driver's handling of XDP_TX actions when using AF_XDP zero-copy. The function stmmac_xdp_xmit_back() fails to check the memory type of the xdp_buff before conversion to an xdp_frame. While page pool-based buffers use MEM_TYPE_PAGE_POOL, zero-copy XSK pool-based buffers use MEM_TYPE_PAGE_ORDER0. Because the driver incorrectly assumes the page pool type for all transmissions, it creates invalid DMA mappings, resulting in a kernel paging request failure and an 'Oops' crash. Patches have been released for various stable kernel branches to implement the necessary memory type checks.
Affected products
- Linux Linux Kernel bba2556efad6 to 3f7823219407f2f18044c2b72366a48810c5c821
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6
Timeline
- 2025-12-04: disclosed: Initial patch submission by Wei Fang
- 2026-01-11: patched: Commits merged into stable kernel branches
- 2026-01-13: advisory: CVE-2025-71095 published
References
- https://git.kernel.org/stable/c/3f7823219407f2f18044c2b72366a48810c5c821
- https://git.kernel.org/stable/c/45ee0462b88396a0bd1df1991f801c89994ea72b
- https://git.kernel.org/stable/c/4d0ceb7677e1c4616afb96abb4518f70b65abb0d
- https://git.kernel.org/stable/c/5e5988736a95b1de7f91b10ac2575454b70e4897
- https://git.kernel.org/stable/c/a48e232210009be50591fdea8ba7c07b0f566a13
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html