Executive brief
A vulnerability in the Linux kernel's stmmac network driver can cause a system crash (kernel oops) when processing certain network traffic. This occurs on hardware using GMAC4 controllers when the 'split header' feature is enabled. An attacker could potentially trigger this crash remotely by sending specific network packets, leading to a denial of service.
Technical details
A vulnerability in the stmmac_napi_poll_rx function of the Linux kernel's stmmac driver leads to a kernel oops. On GMAC4 hardware with split header (SPH) enabled, the driver incorrectly assumed that the second buffer (buf2) of a non-last descriptor was always fully filled. In rare cases, the hardware does not fill buf2 of the first descriptor, causing the driver to miscalculate the length for subsequent descriptors and attempt to access invalid memory addresses. The fix involves using the PL (Packet Length) bit-field from the RDES3 register for all descriptors to accurately determine buffer lengths. Patches have been applied to multiple stable branches of the Linux kernel.
Affected products
- Linux Linux kernel All versions including GMAC4 support prior to the fix
Timeline
- 2026-02-09: other: Patch authored by Jie Zhang
- 2026-02-26: patched: Patch committed to stable trees
- 2026-05-27: disclosed: CVE-2026-45940 published