Executive brief
A vulnerability in the Linux kernel's Airoha Ethernet driver could cause a system crash. The issue occurs when the system processes network traffic, leading to an unsafe memory read that may trigger a page fault. This could result in a denial-of-service, impacting the availability of the affected device.
Technical details
A vulnerability exists in the airoha_dev_xmit() function within the Airoha Ethernet driver (airoha_eth.c). The transmit loop incorrectly reads fragment addresses and lengths during its final iteration when the loop index equals the number of fragments, accessing uninitialized data. While the uninitialized values are not used for transmission, the read operation itself is unsafe and can trigger a kernel page fault. Additionally, the fix addresses a secondary issue by deferring the freeing of socket buffers (skb) until the final packet descriptor is processed in airoha_qdma_tx_napi_poll(). Patches have been released for various stable kernel branches including 6.18.x and 7.0.x.
Affected products
- Linux Linux Kernel 6.11 to 7.1
Timeline
- 2026-04-24: other: Patch authored
- 2026-07-19: disclosed: CVE published