Executive brief
A vulnerability in the Linux kernel's stmmac network driver can cause a system crash (kernel panic) under heavy network load or memory pressure. The stmmac driver is commonly used in embedded systems and hardware with Synopsys Ethernet controllers. If the system runs out of memory while receiving network traffic, the driver may attempt to access an invalid memory location, leading to a complete service outage.
Technical details
A NULL pointer dereference exists in the stmmac_rx() and stmmac_rx_zc() functions of the stmmac driver. The vulnerability is caused by an ambiguity in the DMA descriptor ring lifecycle management where the driver confuses 'full' descriptors (containing data) with 'dirty' descriptors (where the buffer has been passed to the network stack but not yet refilled). When the system is memory-starved, the refill process (stmmac_rx_refill) may fail to allocate new buffers, leaving descriptors in a 'dirty' state with NULL pointers. If the receive loop continues and encounters these dirty descriptors, it attempts to process them as valid data, resulting in a NULL dereference and kernel panic. The fix introduces an explicit check to ensure the receive loop exits if it encounters a dirty descriptor.
Affected products
- Linux Linux Kernel versions using stmmac driver
Timeline
- 2026-04-21: other: Patch authored by Sam Edwards
- 2026-04-28: patched: Mainline patch committed by Paolo Abeni
- 2026-05-28: advisory: CVE-2026-46110 published by NVD
References
- https://git.kernel.org/stable/c/0bb05e6adfa99a2ea1fee1125cc0953409f83ed8
- https://git.kernel.org/stable/c/4af2e62cbcda575a174acd230c3f3a208135e16d
- https://git.kernel.org/stable/c/5c910f7708e3c507b037ca91ca5b09f8cfe71e65
- https://git.kernel.org/stable/c/950cb436165aad0f8f2cd49da3cd07677465bcde
- https://git.kernel.org/stable/c/e1c50b273298c7cd9b08b113e7a7598b531a02f5