Executive brief
A vulnerability in the Linux kernel's MACB network driver could allow a local user to cause a system crash or potentially gain unauthorized access. The issue occurs when the system attempts to read network performance statistics, leading to an improper memory write. This affects various Linux-based systems, including certain industrial controllers like the Siemens SIMATIC S7-1500.
Technical details
An out-of-bounds (OOB) write vulnerability exists in the Cadence MACB ethernet driver (drivers/net/ethernet/cadence/macb_main.c) within the gem_get_ethtool_stats() function. The root cause is a mismatch between the memory allocated for statistics and the amount of data copied; while gem_get_sset_count() correctly identifies active queues, gem_get_ethtool_stats() uses the MACB_MAX_QUEUES constant for its memcpy operation. If the number of active queues is less than the maximum, the driver writes beyond the allocated vmalloc region. This can be triggered by a local user via ethtool IOCTL calls. Patches have been released for multiple stable Linux kernel branches.
Affected products
- Linux Linux Kernel All versions prior to the April 2026 patches
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
Timeline
- 2026-03-23: other: Patch submitted by developer
- 2026-04-22: disclosed: CVE published
- 2026-07-14: advisory: Siemens advisory updated with affected products
References
- https://git.kernel.org/stable/c/240c5302eed83e34e98db18f6795ee5f40814024
- https://git.kernel.org/stable/c/72d96e4e24bbefdcfbc68bdb9341a05d8f5cb6e5
- https://git.kernel.org/stable/c/7ff87da099210856cbfe2f2f7f52ddfa57af4f0c
- https://git.kernel.org/stable/c/95246341945163ad9a250a87ca5bd1c1252777ae
- https://git.kernel.org/stable/c/9596759a84e1dbf2670518d85e969208960041f9
- https://git.kernel.org/stable/c/9738be665544281aa624842812c2fbfed6f88226
- https://git.kernel.org/stable/c/9d74d10e4e26672e139a8bcf8bf95957bf2d160f