Executive brief
A vulnerability was identified in the Linux kernel's networking driver for certain Freescale high-speed data controllers. The software incorrectly handles memory cleanup when shutting down the component, which can lead to system instability or crashes. This issue primarily affects the availability of the system rather than the confidentiality of user data.
Technical details
A vulnerability exists in the net: wan/fsl_ucc_hdlc driver within the Linux kernel due to an incorrect implementation of dma_free_coherent() in the uhdlc_memclean() function. While the receive (rx) and transmit (tx) buffers are allocated as a single contiguous block during initialization (uhdlc_init), the cleanup routine attempted to free them as two separate buffers. This mismatch in allocation and deallocation logic results in kernel memory corruption or a system crash. An attacker with local access and low privileges could potentially trigger this condition during driver re-initialization or shutdown to cause a denial of service. The issue has been resolved by ensuring dma_free_coherent() is called once for the entire contiguous buffer.
Affected products
- Linux Linux Kernel 4.8 to 5.10.252, 5.11 to 5.15.202, 5.16 to 6.1.165, 6.2 to 6.6.128, 6.7 to 6.12.75, 6.13 to 6.18.16, 6.19 to 6.19.6
Timeline
- 2026-05-06: advisory: Initial disclosure and CVE assignment
- 2026-03-04: patched: Fix committed to various stable kernel branches
References
- https://git.kernel.org/stable/c/011ae5dd84dc9f05eb9b8e1adff44252ac776e7b
- https://git.kernel.org/stable/c/0f85a9655445e67bb0238cfc983d7c383b54938e
- https://git.kernel.org/stable/c/36bd7d5deef936c4e1e3cd341598140e5c14c1d3
- https://git.kernel.org/stable/c/6496fb830cbb741d831225cc4e7e5601c6e42970
- https://git.kernel.org/stable/c/84b932bc9899d43e5829e6cf088b72d73a922b2b
- https://git.kernel.org/stable/c/ba8d8429e5d6c36f9a654d2b96b9e043c43d92b4
- https://git.kernel.org/stable/c/d68994e37ac3b285692559776e0279a88a3b5f8d