CVE-2026-45940 Overview
CVE-2026-45940 is a Linux kernel vulnerability in the stmmac network driver affecting GMAC4 hardware when split header mode is enabled. The flaw causes a kernel oops (panic) during receive processing because the driver incorrectly assumes that buf2 of a non-last descriptor is always fully filled with payload. In rare hardware conditions, this assumption fails and produces an invalid virtual address dereference in dcache_inval_poc during stmmac_napi_poll_rx. The result is denial of service through a kernel crash on affected systems using the STMicroelectronics MAC driver.
Critical Impact
Triggering the condition produces a kernel paging request failure on systems running GMAC4 with split header enabled, resulting in system crash and loss of network availability.
Affected Products
- Linux kernel net/ethernet/stmicro/stmmac driver (GMAC4)
- Systems using STMicroelectronics GMAC4 Ethernet controllers with split header feature enabled
- Stable Linux kernel branches prior to the fix commits referenced below
Discovery Timeline
- 2026-05-27 - CVE-2026-45940 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-45940
Vulnerability Analysis
The vulnerability resides in the receive path of the stmmac driver. When split header is enabled on GMAC4, incoming packets are placed across multiple buffers and descriptors. The driver calculates buffer two (buf2) length based on the assumption that a non-last descriptor must contain a fully populated buf2. In rare cases the hardware does not fill buf2 of the first descriptor with payload, leaving the assumption invalid.
When the driver later processes the second descriptor, it derives the buf2 length using the residual size and the assumed fixed allocation. This produces an invalid length that maps to an unmapped or out-of-range virtual address. The subsequent dma_direct_sync_single_for_cpu call invokes dcache_inval_poc against that address and triggers a kernel paging fault, as seen in the reported call trace through stmmac_napi_poll_rx and net_rx_action.
Root Cause
The root cause is an unsafe assumption in descriptor length calculation [CWE-125 class behavior, out-of-bounds read]. The driver did not consult the PL (Payload Length) bit-field in the RDES3 descriptor register for non-last descriptors. The fix uses the PL field for all descriptors, last or not, ensuring the actual hardware-reported payload length governs cache invalidation and buffer access.
Attack Vector
The condition is triggered by network traffic processed through GMAC4 with split header enabled. The trigger is non-deterministic and depends on hardware behavior under specific receive conditions. An attacker on an adjacent network segment could attempt to influence receive timing and packet patterns to increase the probability of the hardware exhibiting the unfilled-buf2 behavior, leading to a kernel crash and denial of service.
No verified proof-of-concept code is available. The vulnerability manifests through normal packet reception when the hardware fails to fill buf2 of the first descriptor with payload. See the Kernel Git Commit 36f81cb7 for the corrective patch details.
Detection Methods for CVE-2026-45940
Indicators of Compromise
- Kernel oops messages referencing dcache_inval_poc, dma_direct_sync_single_for_cpu, and stmmac_napi_poll_rx in the call trace.
- Unable to handle kernel paging request at virtual address entries in dmesg correlated with stmmac receive activity.
- Unexpected system reboots or network interface resets on devices with GMAC4 controllers using split header mode.
Detection Strategies
- Monitor /var/log/kern.log and journalctl -k for stmmac-related paging faults and NAPI poll crashes.
- Audit kernel build configurations and runtime flags to identify hosts running GMAC4 with split header enabled.
- Correlate network device error counters from ethtool -S with kernel crash timestamps to confirm driver-level fault.
Monitoring Recommendations
- Forward kernel logs from embedded and edge devices using GMAC4 hardware to a centralized log analytics platform for crash pattern analysis.
- Track host uptime and crash frequency metrics to detect repeated stmmac-driven panics.
- Alert on call traces containing stmmac_napi_poll_rx paired with paging fault signatures.
How to Mitigate CVE-2026-45940
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the commits below to all systems running the stmmac driver with GMAC4 hardware.
- Identify systems using GMAC4 controllers with split header enabled and prioritize them for patching.
- Reboot patched systems to load the corrected kernel image and verify stmmac driver version post-update.
Patch Information
The fix uses the PL bit-field in the RDES3 register for all descriptors regardless of whether the descriptor is the last in a chain. Patches are available at Kernel Git Commit 36f81cb7, Kernel Git Commit b1f23df0, and Kernel Git Commit babab1b4. Distribution maintainers should backport these commits to supported stable branches.
Workarounds
- Disable the split header feature on GMAC4 interfaces where the patch cannot be immediately applied, accepting the associated performance trade-off.
- Pin affected hosts to a known-good kernel that does not enable split header by default for the stmmac driver.
- Restrict exposure of affected interfaces to trusted network segments to reduce the probability of triggering the hardware condition.
# Verify stmmac driver and kernel version after patching
uname -r
modinfo stmmac | grep -E '^(version|filename):'
dmesg | grep -i stmmac
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
