Executive brief
A vulnerability was identified in the Linux kernel's Airoha Ethernet driver that could cause a system crash. When the driver fails to allocate memory during the initialization of network receive queues, it incorrectly attempts to clean up resources that were never fully created, leading to a null pointer dereference. This could result in a kernel panic and a total loss of system availability.
Technical details
A NULL pointer dereference vulnerability exists in the airoha_eth driver within the Linux kernel. The issue occurs in airoha_qdma_init_rx_queue() when a memory allocation for a queue entry or DMA descriptor list fails. Because the 'ndesc' variable is initialized early, the subsequent call to airoha_qdma_cleanup() assumes the queue was partially initialized and attempts to call netif_napi_del() on a NAPI structure that was never registered via netif_napi_add(). This results in a kernel panic. The fix involves reordering the initialization sequence to ensure 'ndesc' is only set after successful allocation and registration. Additionally, page_pool allocation was moved to prevent memory leaks during descriptor allocation failures.
Affected products
- Linux Linux 6.11 to 6.12.91, 6.18.33, 7.0.10
Timeline
- 2026-06-26: disclosed
- 2026-06-26: advisory