Skip to main content

Linux Kernel EUVDEUVD-2026-32224

| CVE-2026-45940 MEDIUM
2026-05-27 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-fr2g-jcmh-j266
Linux Information Disclosure Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.7 MEDIUM

AC:H reflects the 'rare' hardware timing condition; all other metrics match NVD assessment; no confidentiality or integrity impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 24, 2026 - 17:25 vuln.today
CVSS changed
Jun 24, 2026 - 17:22 NVD
5.5 (MEDIUM)
Patch available
May 27, 2026 - 19:46 EUVD
CVE Published
May 27, 2026 - 14:17 nvd
MEDIUM 5.5
CVE Published
May 27, 2026 - 14:17 nvd
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

net: stmmac: fix oops when split header is enabled

For GMAC4, when split header is enabled, in some rare cases, the hardware does not fill buf2 of the first descriptor with payload. Thus we cannot assume buf2 is always fully filled if it is not the last descriptor. Otherwise, the length of buf2 of the second descriptor will be calculated wrong and cause an oops:

Unable to handle kernel paging request at virtual address ffff00019246bfc0 ... x2 : 0000000000000040 x1 : ffff00019246bfc0 x0 : ffff00009246c000 Call trace: dcache_inval_poc+0x28/0x58 (P) dma_direct_sync_single_for_cpu+0x38/0x6c __dma_sync_single_for_cpu+0x34/0x6c stmmac_napi_poll_rx+0x8f0/0xb60 __napi_poll.constprop.0+0x30/0x144 net_rx_action+0x160/0x274 handle_softirqs+0x1b8/0x1fc ...

To fix this, the PL bit-field in RDES3 register is used for all descriptors, whether it is the last descriptor or not.

AnalysisAI

Kernel crash (oops) in the stmmac GMAC4 Ethernet driver causes a denial of service when split header reception is enabled. The stmmac receive path incorrectly assumes that buf2 of the first DMA descriptor is always fully populated with payload, but the GMAC4 hardware does not guarantee this in all cases. When the assumption is violated, the driver miscalculates the length of buf2 in the second descriptor, resulting in an invalid virtual address dereference deep in the DMA cache-invalidation path, crashing the kernel. No public exploit has been identified at time of analysis, and EPSS is 0.02% (4th percentile), indicating negligible opportunistic exploitation interest.

Technical ContextAI

The affected component is the stmmac (Synopsys DesignWare Ethernet MAC) driver in the Linux kernel networking subsystem, specifically the GMAC4 receive descriptor processing in stmmac_napi_poll_rx(). When split-header RX is enabled, DMA descriptors carry header and payload in separate buffers (buf1 and buf2). The driver incorrectly assumed buf2 of the first descriptor is always fully filled when a packet spans multiple descriptors. The GMAC4 hardware violates this assumption in edge cases, leaving buf2 partially empty. The fix consults the PL (Payload Length) bit-field in the RDES3 register for all descriptors - not just the last one - to determine the actual payload length. The CPE string cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* confirms the scope is the upstream Linux kernel. No CWE is assigned, but the root cause class is an incorrect assumption about hardware-guaranteed invariants leading to a length miscalculation and invalid memory access (conceptually akin to CWE-131: Incorrect Calculation of Buffer Size).

RemediationAI

Upgrade to a patched kernel version: Linux 7.0 for mainline, 6.19.4 for the 6.19.x stable series, or 6.18.14 for the 6.18.x stable series. The upstream fix commits are available at https://git.kernel.org/stable/c/36f81cb7d82e9614a7058da6abdf2e3a03993df1, https://git.kernel.org/stable/c/b1f23df09e7dbf4c86b6908dff7efb8cb2b7d609, and https://git.kernel.org/stable/c/babab1b42ed68877ef669a08384becf281ad2582. If an immediate kernel update is not feasible, disabling split header RX on the stmmac interface is an effective workaround; this can typically be done via ethtool by disabling header splitting offload ('ethtool -K <iface> rx-gro-hw off' or equivalent driver-level parameter), with the trade-off of slightly increased CPU usage for packet processing. Systems that do not use GMAC4-based Ethernet hardware are not affected and require no action.

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected

Share

EUVD-2026-32224 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy