Executive brief
The Linux kernel's rtase (Realtek automotive Ethernet) driver contains a hardware vulnerability where malformed IPv4, IPv6, TCP, or UDP packets can cause the network interface to hang during transmission. An attacker who can send crafted network packets could disrupt network connectivity, causing a denial of service to systems relying on this driver for network communication.
Technical details
The vulnerability exists in the hardware packet parsing stage of the rtase driver before transmission. The hardware parser has multiple weaknesses: (1) it incorrectly parses IPv4 non-initial fragments by checking transport headers at expected offsets without validating fragment offsets, causing a TX hang if transport data is smaller than the minimum required; (2) it performs additional PTP parsing on UDP packets with destination ports 319/320 and may hang if the transport data is below RTASE_MIN_PAD_LEN. The attack vector is network-based—an attacker can craft and transmit malformed packets with incomplete protocol headers or abnormal UDP payload sizes to trigger the hardware hang. This is a local/network denial-of-service issue affecting any system using the affected rtase driver. The fix involves implementing driver-level workarounds: dropping malformed packets, padding transport data to minimum lengths, and validating packet structure before transmission.
Affected products
- Linux Linux kernel versions affected by rtase driver vulnerability (prior to resolution)
Timeline
- 2026-08-10: disclosed