Executive brief
The Linux kernel's TI Ethernet driver (am65-cpsw-nuss) contains a bug in how it extracts the MAC port identifier from packet metadata during reception. Due to improper bit-masking, the driver reads an invalid port ID and attempts to access kernel memory using this invalid index, causing sporadic system crashes. Systems using affected TI Ethernet hardware with this driver are vulnerable to denial of service.
Technical details
The vulnerability is an out-of-bounds array access in the am65-cpsw-nuss Ethernet driver's RX path. The root cause is improper port ID extraction: the driver receives a 16-bit Source Tag from the RX DMA descriptor metadata but fails to mask it to the lower 8 bits (which contain the actual port ID), instead treating the full 16-bit value as a port index. This leads to out-of-bounds memory access when the code subsequently uses this invalid port_id to index port data structures. The vulnerability is triggered on the network data path whenever a packet is received, making it reachable over the network without authentication. The fix masks the extracted port_id with 0xFF to extract only the lower 8 bits. Patches were available from the upstream Linux kernel as of August 2026.
Affected products
- Linux Linux kernel versions prior to patch commit 36a05d2820077bb3955acb8111e1041d39148037
Timeline
- 2026-08-26: disclosed: CVE-2026-74737 published
- 2026-08-23: patched: Upstream kernel fix available in stable trees