Executive brief
A vulnerability in the IBM EMAC network driver within the Linux kernel could lead to a system crash or unpredictable behavior when a network device is removed. This occurs because the system may attempt to process network traffic using hardware resources that have already been shut down. While primarily a stability issue, it could impact the availability of systems using specific IBM network hardware.
Technical details
A use-after-free vulnerability exists in the net: ibm: emac driver due to the use of devm_register_netdev(). This function defers the unregistration of the network device until after the emac_remove() function has already completed hardware teardown. Consequently, a race condition exists where the network stack may trigger interrupt handlers (emac_irq) or polling routines (emac_poll) that access freed hardware structures like dev->emacp or dev->mal. The fix involves replacing the managed registration with manual register_netdev() and explicitly calling unregister_netdev() at the start of the removal process to ensure all network activity ceases before resource deallocation.
Affected products
- Linux Linux Kernel 6.12, 6.18, 7.0
Timeline
- 2026-06-03: other: Patch authored
- 2026-06-25: disclosed: CVE published