PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45940 Linux CVE debrief

A kernel memory corruption vulnerability in the Linux stmmac Ethernet driver can trigger an oops (kernel crash) when the split header feature is enabled on GMAC4 hardware. The root cause is an incorrect assumption in buffer length calculation: the driver assumed buf2 of the first descriptor is always fully filled when it is not the last descriptor, but hardware behavior in rare cases violates this assumption. This leads to an incorrect length calculation for buf2 of the second descriptor, causing an invalid memory access during DMA cache synchronization. The fix utilizes the PL (Payload Length) bit-field in the RDES3 register for all descriptors to correctly determine buffer lengths regardless of descriptor position.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-24
Advisory published
2026-05-27
Advisory updated
2026-06-24

Who should care

Linux system administrators running kernels with stmmac driver on GMAC4 hardware; embedded systems developers using Synopsys DesignWare Ethernet MAC; security teams monitoring for kernel stability issues in network stack

Technical summary

The stmmac (Synopsys DesignWare Ethernet MAC) driver in the Linux kernel contains a vulnerability when operating with split header enabled on GMAC4 hardware. The driver incorrectly calculates buffer lengths by assuming buf2 of non-last descriptors is always fully populated with payload data. In rare hardware conditions, this assumption fails, causing an incorrect length calculation for subsequent descriptors. This leads to an out-of-bounds memory access during the dma_direct_sync_single_for_cpu operation, manifesting as a kernel paging request fault. The vulnerability is addressed by consistently using the PL (Payload Length) field from the RDES3 register across all descriptors to obtain accurate buffer lengths.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel patches from stable branches when available for your distribution
  • Monitor vendor security advisories for stmmac driver updates
  • Consider disabling split header feature on GMAC4 hardware if patches cannot be immediately applied
  • Review system logs for stmmac-related oops messages indicating potential exploitation attempts

Evidence notes

The vulnerability description and fix details are sourced from the official CVE record published 2026-05-27. The kernel commit references confirm the fix was applied to stable kernel branches. The call trace showing dcache_inval_poc and dma_direct_sync_single_for_cpu indicates the crash occurs during receive path DMA operations.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45940 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45940

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45940 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45940

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/36f81cb7d82e9614a7058da6abdf2e3a03993df1

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/b1f23df09e7dbf4c86b6908dff7efb8cb2b7d609

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/babab1b42ed68877ef669a08384becf281ad2582

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.