Linux Kernel CVE-2026-93830

Exploitation requires the target to use the stmmac driver with an XGMAC2 (DWMAC-XGMAC2) 10G MAC core - as found on Intel Agilex5 and similar SoCs - since the RBUE bit in XGMAC_DMA_INT_DEFAULT_EN/_RX is specific to that core. The interrupt storm only manifests under heavy sustained RX pressure that exhausts the DMA RX descriptor ring (or when page_pool is OOM and stmmac_rx_refill() cannot advance the DMA tail pointer). It does not affect other DWMAC core versions or general-purpose NICs. Limiting factors: the narrow hardware requirement drastically shrinks the attack surface, the condition requires prolonged high-rate traffic rather than a single packet, and the impact is CPU starvation/stall (availability) with no data exposure or code execution.

The NVD CVSS 3.1 vector (7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) rates this as a high-severity network-triggerable availability issue, but the vector overstates the real-world risk. The root cause is a self-inflicted MAC interrupt storm: when the XGMAC2 DMA runs out of RX descriptors under heavy receive pressure, the RBUE interrupt fires continuously (observed at ~695x the rate of actual RX completions on Intel Agilex5), starving the CPU. There is no EPSS score, no CISA KEV listing, and no public POC - consistent with no public exploit identified at time of analysis. AC:L is questionable: triggering the storm requires sustained heavy RX load sufficient to exhaust the descriptor ring (or page_pool OOM), which is a demanding, non-trivial condition rather than a single crafted packet, so AC:H is more defensible. Critically, the affected code path only exists on XGMAC2/DWMAC-XGMAC2 hardware (e.g., Intel Agilex5 SoCs), so the practical attack surface is a narrow set of embedded/SoC deployments, not general Linux servers. This is a robustness/stability fix rather than a widely-weaponizable vulnerability - a real fix for affected hardware but low urgency for the broader fleet.

An attacker with network reachability to an XGMAC2/DWMAC-based interface (e.g., an Intel Agilex5 SoC) floods it with sustained high-rate RX traffic until the DMA exhausts its RX descriptor ring. The resulting RBUE interrupt storm - measured at roughly 695 interrupts per genuine RX completion - saturates the CPU with interrupt handling, degrading or stalling the system. No public POC exists, and no confidentiality or integrity impact is possible (C:N/I:N).