CVE-2026-43371 Overview
CVE-2026-43371 is a vulnerability in the Linux kernel's Cadence MACB Ethernet driver (net: macb). The flaw occurs when transmit (TX) is disabled and re-enabled, typically during suspend and resume cycles. The current implementation resets queue->tx_head and queue->tx_tail to zero without properly handling packets already queued in the TX ring. This causes silent packet loss, memory leaks of socket buffers (skb), and stuck transmissions. The issue was observed on AMD ZynqMP boards using an NFS root filesystem, where rootfs recovery after suspend took an extended time. The vulnerability is tracked under [CWE-401] (Missing Release of Memory after Effective Lifetime).
Critical Impact
Local attackers or workloads triggering suspend/resume cycles can cause kernel memory leaks and network availability loss on affected MACB-based systems.
Affected Products
- Linux Kernel (multiple stable branches with the macb driver)
- AMD Zynq UltraScale+ MPSoC platforms using the Cadence MACB Ethernet controller
- Embedded systems and SoCs relying on drivers/net/ethernet/cadence/macb_main.c
Discovery Timeline
- 2026-05-08 - CVE-2026-43371 published to NVD
- 2026-05-15 - Last updated in NVD database
Technical Details for CVE-2026-43371
Vulnerability Analysis
The vulnerability resides in the MACB Ethernet driver's TX ring management logic. When the driver disables transmission, the Zynq UltraScale Technical Reference Manual specifies that the transmit buffer queue pointer is reset to the base address. The driver's existing implementation responds by zeroing queue->tx_head and queue->tx_tail, but does not reconcile the in-flight packets that remain in the TX ring.
Three concrete failure modes result from this design. First, packets already queued in the TX ring are silently dropped, and their associated skb structures are never freed, producing a kernel memory leak. Second, concurrent write access to queue->tx_head and queue->tx_tail can occur from macb_tx_poll() or macb_start_xmit() while the reset is in progress, because no locking guards the operation. Third, transmission may stall on a packet whose TX_USED bit is already set: macb_tx_poll() observes queue->tx_head == queue->tx_tail and incorrectly assumes the ring is empty, leaving the stuck packet unprocessed until a new packet happens to land at the same slot.
Root Cause
The root cause is improper handling of the TX ring state during the transition from disabled to enabled transmit. The driver reinitializes the ring indices without shuffling unsent descriptors to align with the hardware's reset queue pointer, and it performs the index updates without holding the queue lock.
Attack Vector
Exploitation requires local access with the ability to trigger network interface state transitions or system suspend/resume on a host using the MACB driver. The condition is not network-reachable from a remote attacker. Impact is limited to availability and resource consumption, with no confidentiality or integrity exposure.
No verified public exploit or proof-of-concept code is available. See the kernel.org stable commit references for the technical fix details.
Detection Methods for CVE-2026-43371
Indicators of Compromise
- Prolonged delays restoring network connectivity after suspend/resume cycles on MACB-equipped hardware.
- Growing kmemleak reports referencing sk_buff allocations originating from macb_start_xmit().
- TX queue stalls where ifconfig or ethtool -S show transmitted-but-uncompleted packet counters frozen.
Detection Strategies
- Audit running kernel versions against the fixed commits listed in the kernel.org stable advisories for the macb driver.
- Enable CONFIG_DEBUG_KMEMLEAK on test systems to surface leaked skb allocations from the MACB transmit path.
- Monitor dmesg for repeated NFS retransmission errors or TX timeouts on eth* interfaces backed by the Cadence MACB controller.
Monitoring Recommendations
- Track interface counters such as tx_dropped, tx_errors, and queue stop events on MACB-driven NICs via ethtool -S and Prometheus node-exporter.
- Alert on memory growth in slab caches associated with skbuff_head_cache on long-running embedded fleets.
- Correlate suspend/resume events from systemd-logind with subsequent NFS or TCP retransmission spikes.
How to Mitigate CVE-2026-43371
Immediate Actions Required
- Update Linux kernels on affected embedded and AMD Zynq UltraScale+ systems to a version that includes the upstream fix.
- Inventory devices running the Cadence MACB driver, particularly NFS-root deployments, and prioritize them for patching.
- Avoid unnecessary suspend/resume cycles on unpatched systems until the fix is deployed.
Patch Information
The upstream fix shuffles the TX ring and TX skb array so the first unsent packet is repositioned at the start of the ring before transmit is re-enabled, and it protects updates to queue->tx_head and queue->tx_tail with the appropriate lock. Backports are available across stable branches in the following commits: 0a47c388, 403182e0, 58f5d34f, 881a0263, 88f974fe, and c6783bfa.
Workarounds
- Disable system suspend on affected embedded hosts until the kernel is patched.
- Where feasible, switch from NFS root to a local root filesystem to reduce sensitivity to MACB TX stalls.
- Reload the macb driver module after suspend/resume to force a clean reinitialization of TX state, accepting the temporary loss of connectivity.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
