EUVD-2026-45543
GHSA-w58q-3gfq-pjj2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local low-privileged access on Airoha-based device
-
ExploitTrigger QDMA TX queue cleanup
-
ExecutionNIC processes stale TX descriptors
-
ImpactNetwork interface fault / denial of service
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires local access (AV:L) with low privileges (PR:L) on a system running the Linux airoha QDMA Ethernet driver, i.e. Airoha/MediaTek SoC-based networking hardware - this is the primary limiting factor, as the driver is absent on the vast majority of Linux deployments. The attacker must be able to cause the QDMA TX queue cleanup path (airoha_qdma_cleanup_tx_queue) to run, such as through interface teardown or driver error recovery; triggering interface teardown on Linux typically requires network-administration capability, which may make the effective privilege requirement higher than PR:L. Impact is limited to availability (A:H) with no confidentiality or integrity effect, and no user interaction is required. The precise runtime trigger beyond the cleanup routine is not described in the available sources. |
| Impact | This is a low-priority issue despite a medium CVSS base score of 5.5. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) describes a local, low-privilege, availability-only flaw with no confidentiality or integrity impact - a denial-of-service condition, not code execution or data exposure. Supporting signals reinforce low real-world urgency: EPSS is 0.15% (5th percentile), the CVE is NOT on CISA KEV, no public exploit is identified, and the vuln.today decision label is 'this_month' (routine patching, not emergency). One conflicting signal: the input Tags include 'Information Disclosure', which contradicts the CVSS vector's C:N/I:N/A:H (availability-only) classification - the fix resets DMA TX descriptors and the TX ring index, consistent with an availability/stale-descriptor bug rather than a confidentiality leak; treat the 'Information Disclosure' label as suspect and rely on the CVSS availability impact. Net assessment: a genuine but low-severity local DoS affecting only Airoha QDMA-based hardware, appropriate for scheduled patching rather than emergency response. |
| Exploit ScenarioDerived | A local, low-privileged user on a device using the Linux airoha QDMA Ethernet driver triggers TX queue cleanup (for example during interface teardown or error recovery). Because airoha_qdma_cleanup_tx_queue() failed to reset the DMA TX descriptors and to set TX_DMA_IDX to TX_CPU_IDX, the NIC continues to see a non-empty ring and processes stale descriptors, causing DMA faults and a denial of service on the network interface. No public exploit is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 26, 2026
Incomplete TX queue teardown in the Linux kernel's airoha QDMA Ethernet driver leaves DMA TX descriptors and the TX_DMA_IDX register in a stale state, which can hang or crash the network interface - availability impact only, with no confidentiality or integrity effect. The flaw is reachable by a local user with low privileges on systems built around Airoha/MediaTek SoC networking hardware, since the driver is absent from the overwhelming majority of Linux deployments; the CVSS 3.1 score is 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), and the assessed risk is low. No public exploit code was identified at time of analysis, EPSS is 0.15% (5th percentile), and vendor fixes are available for the 6.18.33, 7.0.10 and 7.1 kernel branches.
RemediationAI
Vendor-released patch: fixed in Linux 6.18.33, 7.0.10 and 7.1 (stable commits c0cfce4d76702dba9601a4020df1a0bc35806efc, 9b5d56fe389d68ede080c716e6f10895facaf7db and 3309965fe44c00fd65af7cef5016e9e782c021a7); upgrade affected Airoha/MediaTek SoC networking devices to one of those kernel versions or later, and Ubuntu users should apply USN-8593-1 (https://ubuntu.com/security/notices/USN-8593-1). Because the flaw only lives in this specific SoC Ethernet driver, systems that do not use that hardware are not exposed and do not need emergency action. Where updating a running network appliance must be deferred, the practical compensating control is to restrict local logins and CAP_NET_ADMIN to trusted administrators, since reaching the TX cleanup path depends on actions such as interface teardown or driver error recovery; the trade-off is reduced operational flexibility on multi-tenant or delegated-administration devices, and it does not remove the risk of an untrusted local user already holding network-administration rights.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The airoha QDMA driver is the queue-DMA Ethernet controller support for Airoha/MediaTek SoC-based networking hardware, added to the kernel in the 6.11 timeframe; its TX cleanup path (airoha_qdma_cleanup_tx_queue) is supposed to mirror the RX cleanup path (airoha_qdma_cleanup_rx_queue) when a ring is torn down. The upstream fix notes that the TX routine was missing those reset steps: DMA TX descriptors were not reset and TX_DMA_IDX was not set back to TX_CPU_IDX, so the NIC was never told the QDMA TX ring had become empty. No CWE class is assigned in the available data, and the sources do not describe the precise runtime trigger beyond the cleanup routine itself. Per the assessed vector, exploitation requires local access with low privileges and no user interaction, and the practical trigger (interface teardown or driver error recovery) typically implies a network-administration capability. CPE data lists only generic linux:linux entries, reflecting broad kernel version tracking rather than a specific sub-product.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Driver cleanup-path bug needs local access (AV:L) and some privilege (PR:L); impact is a DoS from stale DMA descriptors, so A:H with C:N/I:N.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
In the Linux kernel, the following vulnerability has been resolved:
net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue()
Similar to airoha_qdma_cleanup_rx_queue(), reset DMA TX descriptors in airoha_qdma_cleanup_tx_queue routine. Moreover, reset TX_DMA_IDX to TX_CPU_IDX to notify the NIC the QDMA TX ring is empty.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB