Executive brief
A vulnerability in the Spacemit K1 Ethernet driver for the Linux kernel could allow an attacker to cause a system crash or instability. The issue occurs when the network driver fails to properly clean up memory during certain error conditions, leading to a resource leak. Over time, this can exhaust system resources and result in a denial-of-service.
Technical details
A memory leak vulnerability exists in the Spacemit K1 Ethernet MAC (emac) driver within the Linux kernel's networking subsystem. The root cause is improper error handling in the emac_tx_mem_map() function, where DMA mappings were not released if a mapping error occurred during transmission. An attacker could potentially trigger this condition remotely by sending specific network traffic that induces mapping failures, leading to kernel resource exhaustion and a denial-of-service (DoS). The fix introduces a loop to properly free the transmit buffers using emac_free_tx_buf() when the err_free_skb path is taken.
Affected products
- Linux Linux Kernel 6.18 to 6.18.19, 6.19 to 6.19.9, 7.0-rc1 to 7.0-rc3
Timeline
- 2026-05-08: disclosed
- 2026-03-06: patched: Initial patch committed to mainline kernel
- 2026-05-08: advisory