Linux Kernel ENET CVE-2026-52079

MEDIUM

2026-08-13 vendor:ubuntu

Severity by source

vuln.today AI

7.5 HIGH

Network-reachable trigger via crafted frames, no auth or interaction needed, impact is total availability loss on the affected interface with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 17:43 vuln.today

DescriptionCVE.org

[ENET_IRQHandler RX descriptor not re-owned on error -- RX ring stall]

AnalysisAI

RX ring stall in the Linux kernel's ENET (Freescale/NXP i.MX Ethernet) interrupt handler causes a network denial-of-service on affected embedded platforms. When an error occurs during packet reception in ENET_IRQHandler, the RX descriptor is not re-owned (returned to hardware DMA control), causing the hardware to believe all remaining descriptors are still held by software and halting all further packet reception. No public exploit has been identified at time of analysis, and this is not listed in CISA KEV, but the network-reachable trigger path means a remote attacker on an adjacent or routed network could potentially stall the interface by provoking the error condition.

Technical ContextAI

The ENET driver (drivers/net/ethernet/freescale/enet or equivalent) implements a ring-buffer architecture for DMA-based packet I/O on NXP/Freescale i.MX SoCs. Each RX descriptor in the ring contains an 'OWN' bit: when set, the DMA hardware owns the descriptor and can write incoming frame data; when cleared, the CPU owns it for processing. In the interrupt handler (ENET_IRQHandler), the normal code path processes an arriving frame and re-arms the descriptor by setting the OWN bit before returning it to the hardware. The defect is in the error exit path: when a reception error is detected mid-handler, the code returns without re-owning the descriptor. Hardware then observes no available descriptors and ceases writing new frames, permanently stalling the RX ring until the interface is reset or the driver is reloaded. The root cause maps conceptually to an error-path resource management failure (failure to release a hardware resource on exceptional path), analogous to CWE-404 or CWE-400, though no CWE is formally assigned in the available data. Ubuntu is the reporting vendor, indicating this was identified via Ubuntu's Linux kernel security team.

Affected ProductsAI

The vulnerability affects the Linux kernel's ENET Ethernet driver, used on NXP/Freescale i.MX SoC-based platforms. Ubuntu is the reporting vendor, confirming affected Ubuntu kernel packages exist, though exact affected kernel version ranges and Ubuntu release series are not specified in the available data. CPE strings are not provided. Administrators should consult the Ubuntu Security Notices (USN) and Ubuntu CVE Tracker at ubuntu.com/security/CVE-2026-52079 for exact affected package versions and series.

RemediationAI

The primary fix is to apply the upstream Linux kernel patch that corrects the ENET_IRQHandler error exit path to re-own the RX descriptor before returning on error, restoring the descriptor to hardware ownership and preventing ring stall. Ubuntu users should apply the relevant kernel security update via 'apt-get update && apt-get upgrade' once a USN is published for CVE-2026-52079. No exact patched kernel version is independently confirmed from the available data - patch availability per Ubuntu vendor report only. As a compensating control pending patching, administrators can configure automatic interface monitoring and restart via systemd or a watchdog script that detects RX packet count stagnation and triggers 'ip link set eth0 down && ip link set eth0 up' or driver reload, restoring reception without a full system reboot. Note this workaround introduces brief network interruption each time it fires. Restricting network access to trusted sources may reduce the attack surface by limiting who can trigger the error condition.