Skip to main content

Linux Kernel EUVDEUVD-2026-27781

| CVE-2026-43219 MEDIUM
2026-05-06 Linux GHSA-86c9-4w26-qf4c
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.7 MEDIUM

AC:H reflects that exploitation requires an uncommon error during driver init on specialized TI SoC hardware, beyond attacker control; all other metrics align with the provided vector.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 24, 2026 - 01:01 vuln.today
CVSS changed
May 12, 2026 - 19:22 NVD
5.5 (MEDIUM)
Patch available
May 06, 2026 - 13:32 EUVD
CVE Published
May 06, 2026 - 11:28 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

net: cpsw_new: Fix potential unregister of netdev that has not been registered yet

If an error occurs during register_netdev() for the first MAC in cpsw_register_ports(), even though cpsw->slaves[0].ndev is set to NULL, cpsw->slaves[1].ndev would remain unchanged. This could later cause cpsw_unregister_ports() to attempt unregistering the second MAC. To address this, add a check for ndev->reg_state before calling unregister_netdev(). With this change, setting cpsw->slaves[i].ndev to NULL becomes unnecessary and can be removed accordingly.

AnalysisAI

Improper error-path cleanup in the Linux kernel's cpsw_new (TI Common Platform Switch) network driver can trigger an attempt to unregister a net device that was never successfully registered, causing a kernel crash or panic and resulting in local denial of service. Systems running affected kernel versions on Texas Instruments SoC hardware - including BeagleBone and AM335x/AM437x platforms - are at risk when the CPSW driver encounters a failure during the first MAC's netdev registration. No public exploit identified at time of analysis and EPSS exploitation probability is extremely low at 0.02% (4th percentile), consistent with its hardware-specific, error-path nature.

Technical ContextAI

The cpsw_new driver (drivers/net/ethernet/ti/cpsw_new.c) manages a dual-MAC Ethernet switch on Texas Instruments CPSW-capable SoCs (CPE: cpe:2.3:a:linux:linux). During cpsw_register_ports(), the driver calls register_netdev() sequentially for each MAC port. If the first call fails, the code sets cpsw->slaves[0].ndev = NULL to indicate failure, but cpsw->slaves[1].ndev retains its pre-call value. When cpsw_unregister_ports() is subsequently invoked in the error cleanup path, it iterates over both slave entries and calls unregister_netdev() on slaves[1].ndev even though that interface was never successfully registered with the kernel. This violates a fundamental invariant of the netdev lifecycle and can result in a kernel oops or BUG() trap. No CWE is formally assigned, but this maps closest to CWE-459 (Incomplete Cleanup) or CWE-755 (Improper Handling of Exceptional Conditions). The tag 'Information Disclosure' present in the intelligence feed is inconsistent with the CVSS vector (C:N) and the description - no confidentiality impact is indicated.

RemediationAI

Upgrade to a patched kernel version: 6.18.16, 6.19.6, or 7.0 (confirmed from EUVD affected-version data). The upstream fixes are available at the following stable kernel commits: 29739ec197ed66535bc0b86f14ab66c5f4512138, 349c4cac6f54a81fc107589771f88136a2b20415, 9d724b34fbe13b71865ad0906a4be97571f19cf5, 14645799ad5253a028cf662e2f9cd18a68f74b31, 23acc565186ee27e788408cbd81b92730b6aaa3a, 67cca9df4d17f2c824655d31195b2e75334ae286, d31a12cee10bbc12b4b523a4709fd1fdee8b7d0f, and da8e1623a3028e1d8c75eec7898d94c6f17dce40 (all retrievable from https://git.kernel.org/stable/c/). As a workaround on systems where upgrading is not immediately feasible, preventing dynamic loading or reloading of the cpsw_new kernel module (e.g., via modprobe blacklisting) eliminates the error path; however, this disables Ethernet on affected TI SoC hardware entirely, which may be unacceptable for embedded deployments. Distro-specific kernel packages from vendors targeting TI SoC platforms (Debian, Ubuntu, Yocto-based) should be monitored for backported fixes.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2026-27781 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy