Executive brief
A vulnerability in the Linux kernel's network driver for XScale hardware could allow a local user to crash the system. The issue occurs when certain network diagnostic tools, like tcpdump, attempt to access time-stamping features on hardware that does not support them. This results in a system 'splat' or kernel crash, potentially disrupting operations and service availability.
Technical details
A NULL pointer dereference exists in the ixp4xx_eth driver within the Linux kernel. The function ixp46x_ptp_find() was being called unconditionally in ixp4xx_get_ts_info(), even on hardware variants (other than ixp46x) that do not support Precision Time Protocol (PTP). When a local user executes tools like tcpdump that trigger ethtool ioctl calls to retrieve timestamping information, the kernel attempts to access uninitialized PTP clock structures, resulting in a kernel panic. The fix introduces a proper check for ixp46x CPU support within the PTP discovery logic. Patches have been released across multiple stable kernel branches.
Affected products
- Linux Linux Kernel 5.15 to 5.15.202, 5.16 to 6.1.165, 6.2 to 6.6.128, 6.7 to 6.12.75, 6.13 to 6.18.16, 6.19 to 6.19.6
Timeline
- 2026-05-06: disclosed: Initial disclosure of the vulnerability
- 2026-05-06: advisory: NVD advisory published
- 2026-02-19: patched: Fix authored by Linus Walleij
References
- https://git.kernel.org/stable/c/21d1e80d0d6e7d0c3cd8b1e001ed1fa92fb9f3f5
- https://git.kernel.org/stable/c/2d74412dfd3621552a394d55cc3dd26a7cbf608e
- https://git.kernel.org/stable/c/322437972f0a712767f6920ad34aba25f2e9b942
- https://git.kernel.org/stable/c/594163ea88a03bdb412063af50fc7177ef3cbeae
- https://git.kernel.org/stable/c/cbecebd35909f6cd0f6fb773f0fb73da99e02f8c