Executive brief
A vulnerability in the Linux kernel's Intel igc network driver can cause a system crash (page fault) when certain high-performance networking applications (XDP) are shut down. This occurs because the system attempts to access memory locations that are no longer valid after the application stops. An exploit could lead to a complete denial of service by crashing the operating system.
Technical details
A page fault vulnerability exists in the igc driver within the Linux kernel due to improper cleanup of xsk_meta pointers during the shutdown of a TX ring. When an XDP application requesting TX timestamping shuts down while the interface link remains up, the IRQ handler (igc_tsync_interrupt) may attempt to access stale metadata, triggering a kernel splat. This is a local attack vector requiring the ability to run XDP applications. The issue has been resolved by ensuring stale XSK metadata is cleaned up during TX shutdown. Patches are available for various stable kernel branches including 6.12.y, 6.18.y, and 6.19.y.
Affected products
- Linux Linux Kernel 6.10 to 6.12.78, 6.18.20, 6.19.10
Timeline
- 2026-02-25: other: Patch authored
- 2026-04-03: advisory: NVD publication date