Executive brief
A race condition was identified in the Linux kernel's Cortina Gemini Ethernet driver. This driver manages network connectivity for specific hardware; a flaw in how it handles incoming data packets could lead to data corruption or system instability when both network ports are used simultaneously. The issue has been resolved by ensuring each network port manages its own data buffers independently.
Technical details
A race condition exists in the gmac_rx() function of the Cortina Gemini Ethernet driver (drivers/net/ethernet/cortina/gemini.c). The driver used a 'static local' sk_buff (SKB) pointer to assemble packet fragments. Because the Gemini hardware features two Ethernet ports that can operate concurrently, simultaneous RX traffic on both ports could lead to interleaved fragment assembly or pointer overwrites. This could result in memory corruption, kernel panics, or data leakage between ports. The fix migrates the RX SKB pointer to the per-port 'gemini_ethernet_port' structure and ensures proper lifecycle management (zeroing the pointer) during NAPI processing, errors, or interface shutdown.
Affected products
- Linux Linux Kernel 4.16 to 6.9.x
Timeline
- 2026-05-09: patched: Initial patch by Linus Walleij
- 2026-07-19: disclosed: CVE published
References
- https://git.kernel.org/stable/c/06937db21ee311ed07eba47954447245041a982d
- https://git.kernel.org/stable/c/27856d533eca3804008695f61c1e4d5ff984196b
- https://git.kernel.org/stable/c/3b249988d774dacf13b203817e971934a42243c4
- https://git.kernel.org/stable/c/67a35e7da7ef9d2f000aa758552a128324c604a0
- https://git.kernel.org/stable/c/6bba24e9ebe6f1c0b356cd471e36bdc7fa434897
- https://git.kernel.org/stable/c/72158ea185b27afae163949b0e86164cb6b64e55
- https://git.kernel.org/stable/c/b6b22824b30e48ce1df3a2e80990f4b8505deb50