CVE-2026-43283: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-43283 Overview

CVE-2026-43283 is a Linux kernel vulnerability in the ec_bhf Ethernet driver. The flaw resides in the error path of the driver's DMA buffer handling routine, where dma_free_coherent() was invoked using priv->rx_buf.alloc_len as the DMA handle argument instead of the correct physical address priv->rx_buf.alloc_phys. This mismatch causes improper unmapping of the receive buffer during cleanup. The upstream fix replaces the incorrect handle with the correct DMA physical address. Multiple stable kernel branches received backported patches.

Critical Impact
Improper DMA buffer unmapping in the ec_bhf driver error path can corrupt kernel DMA state, leading to memory mismanagement on Beckhoff CX series industrial Ethernet hardware.

Affected Products

Linux kernel drivers/net/ethernet/ec_bhf.c (Beckhoff CX5020 EtherCAT driver)
Multiple Linux stable kernel branches receiving the backported fix
Systems using the ec_bhf Ethernet network driver

Discovery Timeline

2026-05-06 - CVE-2026-43283 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43283

Vulnerability Analysis

The vulnerability exists in the ec_bhf Ethernet driver, which supports Beckhoff industrial Ethernet hardware. The driver allocates a coherent DMA buffer for receive operations and tracks both the buffer length (alloc_len) and the physical address (alloc_phys) in the priv->rx_buf structure.

In the error handling path, the driver calls dma_free_coherent() to release the buffer. The Linux DMA API requires this function to receive the size, the virtual address, and the DMA handle returned by the original allocation. The buggy code passed priv->rx_buf.alloc_len as the DMA handle, conflating the buffer size with the address handle.

Because the kernel uses the DMA handle to locate and unmap the IOMMU mapping, supplying an incorrect value results in improper unmapping. The IOMMU entry for the actual buffer is not released, while an arbitrary address derived from the length is treated as a DMA handle.

Root Cause

The root cause is a kernel driver coding error [CWE-related to incorrect resource cleanup] in which an incorrect field of the rx_buf structure was passed to the DMA free routine. The fix changes the argument from priv->rx_buf.alloc_len to priv->rx_buf.alloc_phys so that the correct DMA handle is supplied to dma_free_coherent().

Attack Vector

The defective code path executes only on driver initialization failures, which are typically triggered by hardware faults, resource exhaustion, or probe errors. There is no published remote or local exploitation vector. The primary impact is kernel-side DMA state corruption rather than direct privilege escalation. Refer to the upstream fix commit for the exact patch content.

// No verified exploitation code is available for this issue.
// The fix swaps the DMA handle argument from rx_buf.alloc_len to
// rx_buf.alloc_phys inside the ec_bhf driver error path.

Detection Methods for CVE-2026-43283

Indicators of Compromise

Kernel log entries from the ec_bhf driver indicating probe or initialization failures on systems using Beckhoff CX EtherCAT hardware.
DMA debug warnings (when CONFIG_DMA_API_DEBUG is enabled) reporting unmap operations with mismatched or unknown DMA handles.
Unexpected IOMMU fault messages following ec_bhf driver load failures.

Detection Strategies

Inventory Linux hosts running kernels that include the unpatched ec_bhf driver and verify against the fixed commits referenced in the NVD entry.
Enable kernel DMA API debugging in test environments to surface incorrect dma_free_coherent() calls during driver fault injection.
Review dmesg and journald output for ec_bhf probe failures correlated with subsequent DMA or IOMMU warnings.

Monitoring Recommendations

Centralize kernel logs from industrial control hosts to detect repeated ec_bhf driver load errors.
Track kernel package versions across the fleet and alert on hosts that have not received the relevant stable kernel update.
Monitor for unexpected network interface flaps or driver re-binding events on Beckhoff EtherCAT controllers.

How to Mitigate CVE-2026-43283

Immediate Actions Required

Apply the upstream Linux kernel patch that changes the DMA handle in the ec_bhf error path to priv->rx_buf.alloc_phys.
Update affected hosts to a stable kernel release that includes one of the listed fix commits, such as commit ffe68c3 or commit accd0599.
Reboot systems after kernel updates to ensure the corrected driver is loaded.

Patch Information

The fix is distributed across multiple Linux stable branches. Reference commits include 0f589ee, 1b1371c, 1b1d3c5, 1e300c3, 7e54ff9, 8320727, accd0599, and ffe68c3. Consume the fix through your distribution's kernel update channel.

Workarounds

Blacklist the ec_bhf driver on systems that do not require Beckhoff EtherCAT functionality until a patched kernel is deployed.
Where possible, ensure stable hardware and resource conditions to avoid triggering the driver's error path until the patched kernel is installed.

bash

# Example: prevent loading the ec_bhf driver until the patched kernel is in place
echo 'blacklist ec_bhf' | sudo tee /etc/modprobe.d/blacklist-ec_bhf.conf
sudo update-initramfs -u
# Verify installed kernel after update
uname -r