PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45940 Linux CVE debrief

A kernel memory corruption vulnerability in the Linux stmmac Ethernet driver can trigger an oops (kernel crash) when the split header feature is enabled on GMAC4 hardware. The root cause is an incorrect assumption in buffer length calculation: the driver assumed buf2 of the first descriptor is always fully filled when it is not the last descriptor, but hardware behavior in rare cases violates this assumption. This leads to an incorrect length calculation for buf2 of the second descriptor, causing an invalid memory access during DMA cache synchronization. The fix utilizes the PL (Payload Length) bit-field in the RDES3 register for all descriptors to correctly determine buffer lengths regardless of descriptor position.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Linux system administrators running kernels with stmmac driver on GMAC4 hardware; embedded systems developers using Synopsys DesignWare Ethernet MAC; security teams monitoring for kernel stability issues in network stack

Technical summary

The stmmac (Synopsys DesignWare Ethernet MAC) driver in the Linux kernel contains a vulnerability when operating with split header enabled on GMAC4 hardware. The driver incorrectly calculates buffer lengths by assuming buf2 of non-last descriptors is always fully populated with payload data. In rare hardware conditions, this assumption fails, causing an incorrect length calculation for subsequent descriptors. This leads to an out-of-bounds memory access during the dma_direct_sync_single_for_cpu operation, manifesting as a kernel paging request fault. The vulnerability is addressed by consistently using the PL (Payload Length) field from the RDES3 register across all descriptors to obtain accurate buffer lengths.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel patches from stable branches when available for your distribution
  • Monitor vendor security advisories for stmmac driver updates
  • Consider disabling split header feature on GMAC4 hardware if patches cannot be immediately applied
  • Review system logs for stmmac-related oops messages indicating potential exploitation attempts

Evidence notes

The vulnerability description and fix details are sourced from the official CVE record published 2026-05-27. The kernel commit references confirm the fix was applied to stable kernel branches. The call trace showing dcache_inval_poc and dma_direct_sync_single_for_cpu indicates the crash occurs during receive path DMA operations.

Official resources

2026-05-27