Linux Kernel EUVD-2026-32224

Three simultaneous conditions are required: (1) the target system must use hardware with a Synopsys GMAC4 Ethernet MAC controlled by the Linux stmmac driver; (2) split header RX must be enabled in the stmmac driver configuration (non-default in many distros, but common in embedded BSPs); (3) the attacker or system must generate or receive network traffic that causes the GMAC4 hardware to leave buf2 of the first receive descriptor unfilled - described as a 'rare' hardware edge case, not a consistently reproducible condition. Exploitation is limited by: local or adjacent network triggering only (CVSS AV:L/PR:L), specific GMAC4 hardware requirement (excludes all x86/Intel NIC environments), rare hardware timing condition (not trivially reproducible on demand), and availability-only impact (crash, not code execution or data exfiltration).

Real-world risk is low-to-moderate and confined to specific hardware deployments. CVSS 5.5 (AV:L/AC:L/PR:L/UI:N) reflects local triggering with low-privilege access and high availability impact - a kernel crash. EPSS of 0.02% at the 4th percentile strongly corroborates that this is a niche, hardware-specific defect rather than a broadly targeted vulnerability. No KEV listing and no public POC further support a low urgency rating. The 'Information Disclosure' tag in the ENISA EUVD metadata appears inconsistent with both the description and the CVSS vector (C:N/I:N/A:H); treat that tag as erroneous - this is purely a DoS/crash issue. The key limiting factor is hardware dependency: only systems running Linux on GMAC4-equipped hardware (common in ARM SoC platforms, automotive, and embedded/industrial devices) with split header RX explicitly enabled are exposed. The AC:L rating in the NVD vector may overstate ease of triggering since the description qualifies occurrence as 'rare cases' of hardware behavior, suggesting AC:H is more accurate. SSVC signals: exploitation is unlikely automated (hardware-specific race), technical impact is partial (kernel crash on one interface), making this a 'Track' priority for most defenders rather than an emergency patch.

On an ARM SoC or embedded system (e.g., automotive ECU, industrial gateway) running a vulnerable Linux kernel with the stmmac driver and GMAC4 split header RX enabled, a local low-privileged process generates or receives high-volume network traffic. Under specific timing or packet-size conditions, the GMAC4 hardware leaves buf2 of a receive descriptor unpopulated; the driver then computes a corrupt length for the next descriptor's buf2, passes an out-of-range virtual address into the DMA cache-invalidation routine, and triggers an unhandled kernel paging fault - crashing the system. No public POC exists; reproducing the fault likely requires specific hardware, traffic patterns, and timing.