Executive brief
A vulnerability in the Linux kernel's MediaTek Ethernet driver could allow a local user to cause a system crash or instability. The issue occurs when the system fails to properly handle errors while setting up high-performance networking programs (eBPF). This can lead to memory management errors that disrupt network operations or the entire operating system.
Technical details
A vulnerability exists in the mtk_xdp_setup() function within the MediaTek Ethernet driver (drivers/net/ethernet/mediatek/mtk_eth_soc.c). When an error occurs during the mtk_open routine while setting up an XDP (eXpress Data Path) program, the driver fails to restore the eBPF program pointer to its previous state and incorrectly manages the reference count. Specifically, if mtk_open fails, the code does not reset the 'prog' pointer to 'old_prog' and may incorrectly decrease the reference count of the old program. This can lead to use-after-free or other memory corruption issues, resulting in a kernel panic. The fix ensures that the pointer is reassigned to the old program and the reference count is preserved upon failure.
Affected products
- Linux Linux Kernel 6.0 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.77, 6.13 to 6.18.17, 6.19 to 6.19.7, 7.0-rc1, 7.0-rc2
Timeline
- 2026-03-03: other: Patch authored
- 2026-03-25: advisory: NVD published date
- 2026-03-25: patched: Stable kernel updates released
References
- https://git.kernel.org/stable/c/0abc73c8a40fd64ac1739c90bb4f42c418d27a5e
- https://git.kernel.org/stable/c/29629dd7d37349e9fb605375a75de44ac8926ea9
- https://git.kernel.org/stable/c/6f95b59520278a72df9905db791b7ea31375fbc1
- https://git.kernel.org/stable/c/8c2d76a9658a4dbfcf02f2693a97e2d5ff42197a
- https://git.kernel.org/stable/c/b73dfe1ea7be7a072482434643b517d7726f4c8d
- https://git.kernel.org/stable/c/ff14cd44c85c20ad69479db73698185de291550c