Skip to main content

Linux Kernel CVE-2026-43173

| EUVDEUVD-2026-27734 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-05-06 Linux GHSA-f26q-jhc2-x3h8
Denial Of Service Linux Null Pointer Dereference
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access with standard user privileges suffices to trigger kernel panic via tcpdump; no confidentiality or integrity impact applies.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 24, 2026 - 01:09 vuln.today
CVSS changed
May 12, 2026 - 20:07 NVD
5.5 (MEDIUM)
Patch available
May 06, 2026 - 13:32 EUVD
CVE Published
May 06, 2026 - 11:27 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: ethernet: xscale: Check for PTP support properly

In ixp4xx_get_ts_info() ixp46x_ptp_find() is called unconditionally despite this feature only existing on ixp46x, leading to the following splat from tcpdump:

root@OpenWrt:~

tcpdump -vv -X -i eth0

(...) Unable to handle kernel NULL pointer dereference at virtual address 00000238 when read (...) Call trace: ptp_clock_index from ixp46x_ptp_find+0x1c/0x38 ixp46x_ptp_find from ixp4xx_get_ts_info+0x4c/0x64 ixp4xx_get_ts_info from __ethtool_get_ts_info+0x90/0x108 __ethtool_get_ts_info from __dev_ethtool+0xa00/0x2648 __dev_ethtool from dev_ethtool+0x160/0x234 dev_ethtool from dev_ioctl+0x2cc/0x460 dev_ioctl from sock_ioctl+0x1ec/0x524 sock_ioctl from sys_ioctl+0x51c/0xa94 sys_ioctl from ret_fast_syscall+0x0/0x44 (...) Segmentation fault

Check for ixp46x in ixp46x_ptp_find() before trying to set up PTP to avoid this.

To avoid altering the returned error code from ixp4xx_hwtstamp_set() which before this patch was -EOPNOTSUPP, we return -EOPNOTSUPP from ixp4xx_hwtstamp_set() if ixp46x_ptp_find() fails no matter the error code. The helper function ixp46x_ptp_find() helper returns -ENODEV.

AnalysisAI

NULL pointer dereference in the Linux kernel's ixp4xx Ethernet driver (net/ethernet/xscale) crashes the kernel on Intel IXP4xx-based embedded systems when PTP timestamp queries are made against non-ixp46x hardware. A local authenticated user on affected hardware can trigger a kernel panic simply by running standard tools such as tcpdump or ethtool, causing a full system crash. No active exploitation is confirmed (EPSS 0.02%, no CISA KEV listing), and real-world impact is constrained to legacy IXP4xx-based embedded devices such as OpenWrt-capable routers.

Technical ContextAI

The vulnerability resides in drivers/net/ethernet/xscale/, the Linux kernel driver for Intel IXP4xx XScale-based network processors. The IXP4xx family includes both ixp42x and ixp46x variants; PTP (Precision Time Protocol) hardware timestamping is only available on the ixp46x. The function ixp4xx_get_ts_info() calls ixp46x_ptp_find() unconditionally regardless of the underlying hardware variant. On non-ixp46x hardware the PTP device does not exist, so ixp46x_ptp_find() returns NULL. When the kernel subsequently calls ptp_clock_index() on that NULL pointer, a classic CWE-476 NULL pointer dereference results, producing a kernel oops and system crash. The fix introduces a hardware capability check inside ixp46x_ptp_find() before any PTP setup is attempted, and ensures ixp4xx_hwtstamp_set() consistently returns -EOPNOTSUPP when PTP is unavailable, preserving the prior error-code contract.

RemediationAI

Update to a patched kernel version appropriate to your stable branch: 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6, or 7.0. Upstream fix commits for each stable branch are available at https://git.kernel.org/stable/c/144dde3146985b25fa84d4e4b7c3d11e0f5fc5a4 and related stable-tree commits listed in the references. Ubuntu users should apply the update described in USN-8492-1 at https://ubuntu.com/security/notices/USN-8492-1. Where patching cannot be applied immediately, restrict local user access to raw network socket operations and ethtool by removing CAP_NET_RAW and CAP_NET_ADMIN capabilities from unprivileged users, or enforce strict user namespacing policies that prevent unprivileged packet capture; note that these controls will prevent legitimate network diagnostics by non-root users. The NVD advisory is at https://nvd.nist.gov/vuln/detail/CVE-2026-43173.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-43173 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy