EUVD-2026-66567
GHSA-582m-3r7c-4438
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Availability-only crash on specific TI hardware; adjacent packet reception with high complexity due to reliance on sporadic reserved-bit values, and no confidentiality or integrity impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
On the packet reception path, the ID of the MAC Port on which the packet was received, is embedded in the RX DMA Descriptor's metadata. The ID is extracted using the helper function cppi5_desc_get_tags_ids() which fills in the 16-bit Source Tag into the 'port_id' variable. However, it is only the lower 8-bits of the 16-bit Source Tag that represent the MAC Port ID, while the upper 8-bits are Hardware-Reserved and carry an arbitrary value. With the existing logic, sporadic kernel crash is observed due to the subsequent driver code accessing out-of-bound memory because of an invalid port_id.
Hence, fix the port_id extraction logic to use only the lower 8-bits of the Source Tag as the MAC Port ID.
Articles & Coverage 1
AnalysisAI
Denial of service in the Linux kernel's TI AM65 CPSW NUSS Ethernet driver (am65-cpsw-nuss) allows sporadic kernel crashes because the driver treats the full 16-bit RX DMA descriptor Source Tag as the MAC port ID, when only the lower 8 bits are valid. On affected TI Sitara/K3 (AM65x-class) hardware, the arbitrary hardware-reserved upper 8 bits produce an invalid port_id that subsequent driver code uses to access out-of-bound memory, causing kernel panics. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the target to be running the Linux am65-cpsw-nuss driver on TI AM65x/K3-class Ethernet hardware and to be actively receiving packets on those CPSW MAC ports - the flaw is in how that driver parses the CPPI5 RX DMA descriptor Source Tag, so systems without this TI networking hardware/driver are not affected at all. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals conflict sharply. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | On a TI AM65x/K3-based device (e.g. an industrial gateway or system-on-module) running an unpatched kernel, the CPSW receives frames and the RX descriptor's reserved upper Source-Tag bits occasionally present a non-zero value; the driver derives an out-of-range port_id, indexes past valid memory, and the kernel panics, dropping the device offline. … |
| Remediation | Vendor-released patch: update to a fixed stable kernel for your series - 5.10.266, 5.15.217, 6.1.184, 6.6.153, 6.12.105, 6.18.46, or 7.1.10 or later (mainline fix in the 7.1/7.2 window). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running TI AM65x (Sitara/K3-class) hardware and current kernel versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today