CVE-2026-43173: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-43173 Overview

CVE-2026-43173 is a NULL pointer dereference vulnerability in the Linux kernel's xscale Ethernet driver. The flaw resides in ixp4xx_get_ts_info(), which calls ixp46x_ptp_find() unconditionally even though Precision Time Protocol (PTP) support exists only on ixp46x hardware. On non-ixp46x systems, invoking standard tools such as tcpdump triggers a kernel NULL pointer dereference at virtual address 0x00000238, producing a kernel oops and a segmentation fault in the calling process.

The issue affects Intel IXP4xx-based network devices running affected kernel versions and is reachable through unprivileged ethtool ioctl paths.

Critical Impact
Local users can trigger a kernel NULL pointer dereference through standard ethtool/ioctl operations such as tcpdump, resulting in a denial of service on affected IXP4xx Ethernet hardware.

Affected Products

Linux kernel xscale Ethernet driver (drivers/net/ethernet/xscale/) on IXP4xx platforms
Devices using the ixp4xx_eth driver without ixp46x PTP hardware
Distributions shipping vulnerable mainline and stable Linux kernel branches

Discovery Timeline

2026-05-06 - CVE-2026-43173 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43173

Vulnerability Analysis

The vulnerability is a kernel NULL pointer dereference [CWE-476] in the IXP4xx Ethernet timestamping code path. When user space queries timestamping capabilities through ethtool (for example, when tcpdump opens a capture session), the kernel invokes __ethtool_get_ts_info(), which calls the driver-provided ixp4xx_get_ts_info(). That function unconditionally calls ixp46x_ptp_find(), which in turn dereferences a PTP clock structure that does not exist on non-ixp46x SoCs.

The resulting call chain visible in the oops is ptp_clock_index ← ixp46x_ptp_find ← ixp4xx_get_ts_info ← __ethtool_get_ts_info ← __dev_ethtool ← dev_ethtool ← dev_ioctl ← sock_ioctl ← sys_ioctl. Because the path is reachable by any local process able to open a socket and issue an ioctl on the interface, the bug is trivially triggered on affected hardware.

Root Cause

The driver assumes PTP hardware support across the entire IXP4xx family. In reality, PTP exists only on the ixp46x variant. The helper ixp46x_ptp_find() does not validate the underlying SoC before dereferencing PTP clock state, so on non-ixp46x systems it operates on uninitialized or NULL pointers.

Attack Vector

The vulnerability is reachable from local user space via the standard SIOCETHTOOL ioctl. Any tool that queries timestamping capabilities, including tcpdump -i eth0 and ethtool -T eth0, triggers the dereference. No special privileges beyond opening a network socket are required to crash the kernel on affected hardware. The flaw is not remotely exploitable.

The upstream fix adds an explicit ixp46x check inside ixp46x_ptp_find() before any PTP setup, and ixp4xx_hwtstamp_set() is updated to return -EOPNOTSUPP whenever the helper fails, preserving its prior error contract while the helper itself returns -ENODEV.

Detection Methods for CVE-2026-43173

Indicators of Compromise

Kernel oops messages referencing Unable to handle kernel NULL pointer dereference at virtual address 00000238
Stack traces containing ptp_clock_index, ixp46x_ptp_find, and ixp4xx_get_ts_info
Segmentation faults in tcpdump, ethtool, or other packet-capture utilities on IXP4xx devices

Detection Strategies

Inventory embedded and OpenWrt devices running IXP4xx hardware and identify kernels that predate the upstream fix commits referenced in the kernel.org stable tree.
Monitor dmesg and persistent kernel logs (/var/log/kern.log, journalctl -k) for NULL pointer dereferences in the ixp4xx_eth call path.
Correlate user-space crashes of network diagnostic tools with simultaneous kernel oops events on the same host.

Monitoring Recommendations

Forward kernel logs from edge and embedded Linux devices to a central log pipeline and alert on kernel NULL pointer dereference events.
Track package and firmware versions across IXP4xx fleets to confirm patched kernels are deployed.
Audit invocation of ethtool -T and packet-capture tooling on affected hardware to identify hosts exposed to crash conditions.

How to Mitigate CVE-2026-43173

Immediate Actions Required

Update the Linux kernel on affected IXP4xx devices to a stable release that includes the fix commits listed in the upstream references.
Restrict execution of network diagnostic utilities such as tcpdump and ethtool on unpatched IXP4xx systems until the kernel is updated.
Validate that distribution and OpenWrt image rebuilds incorporate the patched xscale driver before deployment.

Patch Information

The fix is available across multiple stable branches via the following commits: 144dde31, 21d1e80d, 2d74412d, 32243797, 5195b10c, 594163ea, and cbecebd3. The patch makes ixp46x_ptp_find() verify the SoC is ixp46x before touching PTP state and forces ixp4xx_hwtstamp_set() to return -EOPNOTSUPP when the helper fails.

Workarounds

Avoid running tcpdump, ethtool -T, and other timestamping queries against the IXP4xx Ethernet interface on unpatched systems.
Limit local shell access on affected embedded devices to trusted operators to reduce the chance of accidental denial of service.
Where feasible, replace IXP4xx hardware lacking long-term kernel support with maintained platforms.

bash

# Verify the running kernel and confirm the patch is applied
uname -r
zcat /proc/config.gz | grep -i IXP4XX
dmesg | grep -i 'ixp4xx\|ptp_clock_index'