Executive brief
A vulnerability in the Linux kernel's Network Controller Sideband Interface (NCSI) could allow an attacker to cause a denial-of-service condition. NCSI is a protocol used to connect a network controller to a management controller. By sending specific malformed network packets, an attacker can trigger a memory leak that eventually exhausts system resources, potentially leading to a system crash or instability.
Technical details
A memory leak vulnerability exists in the Linux kernel's NCSI (Network Controller Sideband Interface) implementation within the net/ncsi component. The functions ncsi_aen_handler() and ncsi_rcv_rsp() contain early return paths that fail to release the socket buffer (skb) when encountering invalid packets or failing to resolve device handlers. An unauthenticated remote attacker can exploit this by sending specially crafted NCSI packets, leading to kernel memory exhaustion (SLAB/SLUB leak). The issue has been resolved by ensuring kfree_skb() is called in all error paths. Patches are available in various stable kernel branches (e.g., 5.10.y, 5.15.y, 6.1.y, etc.) as of March 2026.
Affected products
- Linux Linux Kernel All versions prior to the March 2026 patches
Timeline
- 2026-03-05: other: Patch submitted by Jian Zhang
- 2026-03-25: patched: Patches committed to stable kernel trees
- 2026-05-08: advisory: CVE published by kernel.org
References
- https://git.kernel.org/stable/c/553366c271479c0d571dd1bb5d1bcde4747fb82e
- https://git.kernel.org/stable/c/59962588197863d0d746879f193905c0c6b3df49
- https://git.kernel.org/stable/c/5c3398a54266541610c8d0a7082e654e9ff3e259
- https://git.kernel.org/stable/c/81d6aee32f8f7bbc175c05dbf61f4430bfb88c4a
- https://git.kernel.org/stable/c/87138dde2d6937b12b967f28fe598a7d59000ae4
- https://git.kernel.org/stable/c/9891d7f4f1ede473c54b49776ae07755083eef06
- https://git.kernel.org/stable/c/b70c4e5e711931cdd56e6e905737b72f1e649189