Linux Kernel CVE-2026-52047

MEDIUM

2026-08-13 vendor:ubuntu

Severity by source

vuln.today AI

7.7 HIGH

Network-triggered via crafted packet (AV:N), but precise buffer-boundary alignment required (AC:H); no auth needed; memory corruption risks integrity and availability most severely.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 20:18 vuln.today

DescriptionCVE.org

[w5100_rx wraparound RX path copies n instead of r bytes]

AnalysisAI

Off-by-one byte-count error in the Linux kernel's w5100 Ethernet driver corrupts kernel memory during RX buffer wraparound. The w5100_rx function copies n (total packet length) bytes instead of r (remaining bytes before circular buffer end) during the wraparound segment of a split receive operation, causing a kernel-space buffer overread or overwrite. Reported by Ubuntu; no CVSS score, KEV status, or public exploit has been identified at time of analysis, but kernel memory corruption in a network-receive path carries inherent escalation potential.

Technical ContextAI

The WIZnet W5100 is a hardware-offload Ethernet controller used predominantly in embedded Linux systems. Its Linux kernel driver (drivers/net/ethernet/wiznet/w5100.c) manages a fixed-size, circular RX FIFO. When a received packet spans the physical end of the ring buffer, the read is split: first r bytes from the current pointer to the buffer end, then the remainder from the buffer start. The described bug substitutes n (the full packet byte count) for r (remaining bytes in the first segment), meaning the first memcpy or SPI/bus transfer request uses the wrong length. Depending on whether n > r, this either reads stale kernel memory past the buffer window or triggers an overwrite into adjacent kernel data. No CWE is formally assigned, but this maps conceptually to CWE-131 (Incorrect Calculation of Buffer Size) and CWE-120 (Buffer Copy without Checking Size of Input). No CPE string was supplied; affected kernel versions are not confirmed from available data.

Affected ProductsAI

The vulnerability affects the Linux kernel w5100 Ethernet driver, specifically the w5100_rx wraparound receive path. Exact kernel version ranges are not confirmed from the available data - only an Ubuntu vendor report is present. Systems running Linux with WIZnet W5100 or W5100S hardware attached (typically SPI-connected on embedded boards) and the w5100 kernel module loaded are in scope. No CPE string or vendor advisory URL was provided in the input data; consumers should monitor the Ubuntu Security Notices portal and the upstream kernel git tree for the authoritative affected-version range.

RemediationAI

No exact patched kernel version is confirmed from the available input data - only Ubuntu vendor sourcing is noted. Users should apply the latest Ubuntu kernel security updates via apt-get update && apt-get dist-upgrade and monitor Ubuntu Security Notices for a formal USN advisory. For upstream Linux, track the kernel mailing list and git history for a commit that corrects the n-to-r substitution in the w5100_rx wraparound path. As a compensating control on affected embedded systems where patching is not immediately possible, consider disabling the w5100 module (rmmod w5100) if the hardware is not actively in use, or apply egress/ingress packet-size filtering on the network segment to prevent packets of the wraparound-triggering size from reaching the device - note this is an imprecise workaround and does not eliminate risk. No patch version should be cited here as none has been independently confirmed.