net: stmmac: Prevent NULL deref when RX memory exhausted
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: Prevent NULL deref when RX memory exhausted The CPU receives frames from the MAC through conventional DMA: the CPU allocates buffers for the MAC, then the MAC fills them and returns ownership to the CPU. For each hardware RX queue, the CPU and MAC coordinate through a shared ring array of DMA descriptors: one descriptor per DMA buffer. Each descriptor includes the buffer's physical address and a status flag ("OWN") indicating which side owns the buffer: OWN=0 for CPU, OWN=1 for MAC. The CPU is only allowed to set the flag and the MAC is only allowed to clear it, and both must move through the ring in sequence: thus the ring is used for both "submissions" and "completions." In the stmmac driver, stmmac_rx() bookmarks its position in the ring with the `cur_rx` index. The main receive loop in that function checks for rx_descs[cur_rx].own=0, gives the corresponding buffer to the network stack (NULLing the pointer), and increments `cur_rx` modulo the ring size. After the loop exits, stmmac_rx_refill(), which bookmarks its position with `dirty_rx`, allocates fresh buffers and rearms the descriptors (setting OWN=1). If it fails any allocation, it simply stops early (leaving OWN=0) and will retry where it left off when next called. This means descriptors have a three-stage lifecycle (terms my own): - `empty` (OWN=1, buffer valid) - `full` (OWN=0, buffer valid and populated) - `dirty` (OWN=0, buffer NULL)
CVE-2026-46110
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-46110
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "7414a28de1b3b028714859078c00a874f9feff52",
"lessThan": "fdeb95b1fc7de25c9362990efb9996a8d761055c",
"versionType": "git"
},
{
"status": "affected",
"version": "779334e59850f863bf34665e0ff0b6faf126873b",
"lessThan": "e1c50b273298c7cd9b08b113e7a7598b531a02f5",
"versionType": "git"
},
{
"status": "affected",
"version": "b6cb4541853c7ee512111b0e7ddf3cb66c99c137",
"lessThan": "5c910f7708e3c507b037ca91ca5b09f8cfe71e65",
"versionType": "git"
},
{
"status": "affected",
"version": "b6cb4541853c7ee512111b0e7ddf3cb66c99c137",
"lessThan": "4af2e62cbcda575a174acd230c3f3a208135e16d",
"versionType": "git"
},
{
"status": "affected",
"version": "b6cb4541853c7ee512111b0e7ddf3cb66c99c137",
"lessThan": "950cb436165aad0f8f2cd49da3cd07677465bcde",
"versionType": "git"
},
{
"status": "affected",
"version": "b6cb4541853c7ee512111b0e7ddf3cb66c99c137",
"lessThan": "0bb05e6adfa99a2ea1fee1125cc0953409f83ed8",
"versionType": "git"
},
{
"status": "affected",
"version": "b435b4573240b5530830a1a60e005c6fcfd928a0",
"versionType": "git"
},
{
"status": "affected",
"version": "6.1.64",
"lessThan": "6.1.176",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.6.3",
"lessThan": "6.6.140",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.5.13",
"lessThan": "6.6",
"versionType": "semver"
}
],
"programFiles": [
"drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.7",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver",
"lessThanOrEqual": "7.0.*"
},
{
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-46110
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #28390 · Revision 1
- Added to Heist Feed
- Publisher date