Executive brief
A vulnerability in the Linux kernel's network switch driver for certain Freescale hardware can lead to a system hang or performance degradation. When the system receives an unexpected identifier during a hardware interrupt, it fails to reset the interrupt signal, causing the processor to be overwhelmed by a continuous loop of requests. This 'interrupt storm' can result in a denial of service, impacting the availability of the affected device.
Technical details
A logic error exists in the dpaa2-switch driver (drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c) within the Linux kernel. A previous security fix introduced a bounds check for the 'if_id' extracted from the interrupt status register to prevent out-of-bounds memory access. However, if the check fails, the code exits the interrupt handler without calling dpsw_clear_irq_status(). Because the interrupt remains asserted, the CPU is immediately re-interrupted, causing an 'interrupt storm' that consumes CPU resources. An attacker with local access or the ability to trigger specific hardware states could exploit this to cause a Denial of Service (DoS). Patches have been released across multiple stable kernel branches.
Affected products
- Linux Linux Kernel dpaa2-switch driver
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
Timeline
- 2026-02-26: other: Patch authored by Guenter Roeck
- 2026-04-03: disclosed: Initial publication date
References
- https://git.kernel.org/stable/c/00f42ace446f1e4bf84988f2281131f52cd32796
- https://git.kernel.org/stable/c/28fd8ac1d49389cb230d712116f54e27ebec11b8
- https://git.kernel.org/stable/c/74badb9c20b1a9c02a95c735c6d3cd6121679c93
- https://git.kernel.org/stable/c/7def51cb9fb8b8d5342443372b8cf28d8fbd7f3d
- https://git.kernel.org/stable/c/b5bababe7703a7322bc59b803ab1587887a2a5e4
- https://git.kernel.org/stable/c/c7becfe3e604d138bd53b8ac3111b2b3e8ec6b0e
- https://git.kernel.org/stable/c/fa4412cdc5178a48799bafcb8af28fd2fbf3d703