CVE-2026-31563: Linux Kernel DoS in macb network driver via invalid IRQ context

CVE-2026-31563 · Severity: high · CVSS 7.5 · Published 2026-04-24

A vulnerability exists in the Linux kernel's network driver for Cadence MACB Ethernet controllers, which are commonly used in embedded systems and industrial controllers like Siemens SIMATIC S7-1500. The issue involves improper handling of network memory buffers during high-traffic scenarios, which can lead to system instability or a crash. An exploit could result in a denial-of-service, disrupting network communications and operational availability.

Technologies: Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP. Vendors: Linux, Siemens.

Quick answers

Is CVE-2026-31563 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-31563 being exploited in the wild.
How severe is CVE-2026-31563?
High severity, with a CVSS score of 7.5, published 24 April 2026.
Which products and versions are affected?
Linux Kernel 7.0.0-rc4-next-20260319-yocto-standard-dirty; Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6; Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6.
Is there a fix for CVE-2026-31563?
A patch was published on 2026-03-21: Initial patch authored by Kevin Hao Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-31563 attacked?
It is attacked over the network, in an operating system.
Am I affected by CVE-2026-31563?
Check whether you run Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP or Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a kernel panic/instability issue in the macb network driver (drivers/net/ethernet/cadence/macb_main.c). It was introduced by a previous locking fix (commit 6bc8a5098bf4) that resulted in TX SKB freeing being performed with interrupts (IRQs) disabled. The driver incorrectly calls napi_consume_skb() in this context, which is not permitted and triggers a kernel warning/trace in __local_bh_enable_ip. An attacker can potentially trigger this condition via network traffic, leading to a Denial of Service (DoS). The fix replaces the invalid call with dev_consume_skb_any(), which is safe for use in any context.

Affected products

  • Linux Linux Kernel 7.0.0-rc4-next-20260319-yocto-standard-dirty
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6

Timeline

  • 2026-03-21: patched: Initial patch authored by Kevin Hao
  • 2026-04-24: advisory: CVE published to NVD
  • 2026-07-14: other: Siemens product impact information added to advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.