Executive brief
A vulnerability was identified in the Linux kernel's ENETC network driver that could lead to memory corruption. The issue occurs when the system incorrectly manages memory buffers used for hardware communication, potentially allowing data to be written to memory that has already been freed and repurposed. This could lead to system instability or unpredictable behavior in affected networking hardware.
Technical details
A DMA use-after-free vulnerability exists in the Linux kernel enetc driver within the NETC Management Protocol (NTMP) implementation. The root cause is a failure to explicitly abort pending commands when netc_xmit_ntmp_cmd() times out, combined with unconditional freeing of the DMA buffer via ntmp_free_data_mem(). If the hardware subsequently processes the delayed command, it performs a DMA write to the physical address of the freed buffer, which may have been reallocated. The fix involves converting the ring lock to a mutex to allow sleeping during DMA reclamation, introducing software shadow Buffer Descriptors (BDs) to track memory lifecycle independently of hardware write-backs, and ensuring the caller holds the ring lock throughout the command execution and response consumption.
Affected products
- Linux Linux Kernel 4701073c3deb to 37c8933064be714ee672b0a0523c2fd045b73b3d
Timeline
- 2026-04-15: patched: Initial patch authored by Wei Fang
- 2026-06-26: advisory: CVE-2026-53300 published