Executive brief
A vulnerability was identified in the Linux kernel's Airoha Ethernet driver that could cause a system crash. The issue occurs during the initialization of network transmission queues; if memory allocation fails, the system attempts to clean up resources that were never properly set up, leading to a crash. This primarily impacts system stability and availability.
Technical details
A NULL pointer dereference exists in the airoha_qdma_cleanup_tx_queue() function within the Airoha Ethernet driver (drivers/net/ethernet/airoha/airoha_eth.c). The root cause is the premature initialization of the 'ndesc' variable in airoha_qdma_init_tx_queue() before the queue entry array is successfully allocated via devm_kzalloc(). If allocation fails, the cleanup routine uses the initialized 'ndesc' value to iterate over a NULL 'entry' pointer. The fix involves deferring 'ndesc' initialization until after all memory allocations for the queue are successful. This is a local vulnerability that can be triggered during driver initialization or interface setup, resulting in a kernel oops/denial of service.
Affected products
- Linux Linux 6.19, 7.0.10, 7.1
Timeline
- 2026-06-26: advisory
- 2026-06-26: disclosed