Executive brief
The Linux kernel's Ethernet driver (stmmac) has an alignment bug in packet reception that causes system crashes on ARM32 processors. When network packets arrive, the driver incorrectly positions data in memory, triggering a fatal alignment exception that halts the system. Any incoming network packet can trigger this panic, making affected systems unavailable.
Technical details
The vulnerability is a memory alignment issue in the stmmac Ethernet driver's RX (receive) DMA offset calculation. After a zero-copy optimization, the driver stopped accounting for NET_IP_ALIGN (2 bytes on many architectures), causing IP headers to land at misaligned addresses (e.g., 98 bytes instead of the expected even boundary). On ARM32, CPU instructions like ldm and ldrd trap on unaligned memory access, causing an immediate kernel panic when the kernel attempts to process the received packet headers (specifically in icmp_echo()). The condition is triggered by any incoming network traffic, particularly ICMP echo requests. The fix restores NET_IP_ALIGN to the RX offset calculation, which was previously accounted for in the page pool allocation after a later refactor.
Affected products
- Linux Linux Kernel affected versions include commits after df542f669307 ("net: stmmac: Switch to zero-copy in non-XDP RX path")
Timeline
- 2026-09-17: disclosed
- patched: Fix adds NET_IP_ALIGN back to stmmac_rx_offset()