CVE-2026-90591: NXP ENET-QOS Ethernet driver DMA descriptor memory corruption

CVE-2026-90591 · Severity: high · CVSS 7.5 · Published 2026-11-09

The NXP ENET-QOS Ethernet driver contains a bug in how it recycles receive descriptor ring slots when packets are dropped due to errors or resource exhaustion. An attacker sending specially crafted or malformed Ethernet frames can poison descriptor slots, causing the hardware to write subsequent received data to arbitrary memory locations derived from packet VLAN tags rather than valid receive buffers. This results in permanent network interface failure or silent data corruption, and can be triggered by a single malformed frame with no special privileges required.

Vendors: NXP.

Quick answers

Is CVE-2026-90591 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-90591 being exploited in the wild.
How severe is CVE-2026-90591?
High severity, with a CVSS score of 7.5, published 9 November 2026.
Which products and versions are affected?
NXP ENET-QOS Ethernet driver.
Is there a fix for CVE-2026-90591?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-90591 attacked?
It is attacked over the network, in device firmware.
Am I affected by CVE-2026-90591?
Check whether you run NXP ENET-QOS Ethernet driver. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The receive work handler fails to restore the correct DMA buffer address (desc->read.buf1_addr) before re-arming descriptor ring slots in four drop paths: invalid descriptors, allocation failures, and frame errors. Hardware write-back aliases the buffer address field with VLAN tag fields, so corrupted slots cause DMA writes to addresses derived from received packet metadata. On MCX SoCs, this targets flash or reserved memory, triggering a fatal unrecoverable bus error; on other platforms the write is silently discarded but the stale buffer is delivered to the network stack as valid received data.

Affected products

  • NXP ENET-QOS Ethernet driver

Timeline

  • 2026-11-09: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.