Linux Kernel EUVD-2026-27734

Exploitation requires local authenticated access (CVSS PR:L) to a system running the Linux kernel on Intel IXP4xx XScale hardware that is specifically a non-ixp46x variant (e.g., ixp42x) - hardware that lacks PTP support. The crash is triggered by invoking ethtool timestamp information queries or running packet capture tools (tcpdump) against an Ethernet interface managed by the ixp4xx driver; no special exploit code or crafted packets are needed. Limiting factors are substantial: (1) the underlying hardware must be an IXP4xx-class processor without PTP support, restricting impact to a narrow set of legacy embedded devices; (2) the attacker must hold a local shell account on the device; (3) the kernel must be running an unpatched version within the affected range. Systems on ixp46x hardware where PTP is actually present are not affected, because the PTP pointer will be valid. Remote or network-based exploitation is not possible per the AV:L CVSS vector.

The vendor-assigned CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) is well-calibrated for this vulnerability. The local attack vector and requirement for standard user privileges (PR:L) substantially bound the threat surface. EPSS at 0.02% (7th percentile) corroborates the assessment that real-world exploitation is extremely unlikely, consistent with the highly narrow hardware scope. There is no CISA KEV listing and no public exploit identified at time of analysis. The sole impact is availability - a full kernel panic - with no confidentiality or integrity exposure. The most significant risk-limiting factor is hardware: exploitation is only possible on systems using legacy Intel IXP4xx XScale processors that are not ixp46x variants, a population restricted almost entirely to older embedded routers. For organizations running modern servers, cloud infrastructure, or x86-based Linux deployments, this vulnerability poses no realistic risk. The only environments warranting prioritized remediation are OpenWrt or similarly embedded IXP4xx deployments where local shell access may be reachable by less trusted users.

A local user on an IXP4xx-based embedded router running an unpatched kernel (for example, an OpenWrt device on ixp42x hardware) executes tcpdump -i eth0, which causes the kernel to invoke ixp4xx_get_ts_info() as part of the ethtool timestamp info path. The driver unconditionally calls ixp46x_ptp_find(), which returns NULL on non-ixp46x hardware, and the subsequent call to ptp_clock_index() on that NULL pointer triggers a kernel NULL pointer dereference, crashing the system. No exploit code is required beyond standard administrative or diagnostic tools already present on the device.