Executive brief
A vulnerability was identified in the Linux kernel's txgbe network driver, which is used for certain Ethernet hardware. The driver failed to properly terminate internal data lists, which could lead to system instability or a crash. This issue primarily affects the availability of the system and could be used by a local attacker to cause a denial-of-service condition.
Technical details
The vulnerability exists in the txgbe Ethernet driver within the Linux kernel. Lists of 'struct property_entry' are required to be terminated with an empty property (null terminator); however, the driver was allocating exactly the amount of entries used without leaving space for this terminator. This flaw can lead to out-of-bounds reads or writes when the kernel iterates through these property lists. An attacker with local access could potentially exploit this to cause a kernel panic or denial-of-service. The issue has been resolved by increasing the array sizes in the 'txgbe_nodes' struct definition to include the necessary termination element.
Affected products
- Linux Linux Kernel 6.5 to 6.6.136, 6.7 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14, 7.0-rc1 to 7.0-rc7
Timeline
- 2026-04-05: patched: Initial patch authored by Fabio Baltieri
- 2026-05-06: disclosed: CVE published by kernel.org
- 2026-05-06: advisory
References
- https://git.kernel.org/stable/c/00e1d650fa4b228ef1faea8e29effe4b4861e6e4
- https://git.kernel.org/stable/c/16eb3c2f86de9a21aefe7a6386607d4cd3947a77
- https://git.kernel.org/stable/c/5a37d228799b0ec2c277459c83c814a59d310bc3
- https://git.kernel.org/stable/c/8eff73e58e1f8fe991522acb863164319a7f7dd3
- https://git.kernel.org/stable/c/92c09262dac565a6b831fd724b81fe4ff76f51b4