CVE-2026-46110 Overview
CVE-2026-46110 is a NULL pointer dereference vulnerability in the Linux kernel's stmmac network driver. The flaw resides in the receive path that coordinates DMA buffers between the CPU and the MAC controller. When RX memory becomes exhausted, stmmac_rx_refill() fails to allocate fresh buffers, leaving descriptors in a dirty state with NULL buffer pointers. The receive loop then misidentifies these dirty descriptors as full and dereferences the NULL buffer, triggering a kernel panic.
Critical Impact
Sustained memory pressure on systems using stmmac-driven network interfaces can crash the Linux kernel, resulting in denial of service on affected embedded and SoC platforms.
Affected Products
- Linux kernel versions containing the stmmac driver prior to the upstream fix
- Embedded systems and SoCs using STMicroelectronics MAC controllers (common on ARM platforms)
- Stable kernel trees updated via commits 0bb05e6, 4af2e62, 5c910f77, 950cb436, and e1c50b27
Discovery Timeline
- 2026-05-28 - CVE-2026-46110 published to NVD
- 2026-05-28 - Last updated in NVD database
Technical Details for CVE-2026-46110
Vulnerability Analysis
The stmmac driver uses conventional DMA to receive frames from the MAC. For each hardware RX queue, the CPU and MAC coordinate through a shared ring array of DMA descriptors. Each descriptor contains a buffer's physical address and an OWN flag indicating ownership: OWN=0 for CPU, OWN=1 for MAC.
Descriptors progress through three states: empty (OWN=1, valid buffer), full (OWN=0, valid populated buffer), and dirty (OWN=0, NULL buffer). The stmmac_rx() function tracks position with cur_rx, while stmmac_rx_refill() tracks position with dirty_rx and allocates fresh buffers to rearm descriptors.
Root Cause
The stmmac_rx() loop checks only the OWN flag and cannot distinguish between full and dirty descriptors. A prior fix capped loop iteration at dma_rx_size - 1 to prevent cur_rx from cycling back to the first dirtied descriptor. However, this protection fails when stmmac_rx_refill() partially completes due to memory exhaustion. Leftover dirty descriptors remain mid-ring, and the receive loop dereferences their NULL buffer pointers without needing to cycle fully around the ring.
Attack Vector
The vulnerability triggers under sustained memory pressure that prevents stmmac_rx_refill() from successfully allocating fresh RX buffers. When cur_rx catches up to dirty_rx, the driver dereferences a NULL pointer and panics the kernel. The condition can be induced by heavy network throughput combined with system-wide memory starvation, making this primarily a local denial-of-service condition on affected hardware platforms.
The upstream fix adds an explicit check before advancing cur_rx: if the next entry is dirty, the loop exits. This prevents processing the final used descriptor until stmmac_rx_refill() succeeds and removes the ambiguity between full and dirty states. Because stmmac_rx_zc() is a copy of stmmac_rx() with identical structure, the same fix is applied to the zero-copy path. See the Kernel Patch 5c910f77 for the corrective code.
Detection Methods for CVE-2026-46110
Indicators of Compromise
- Kernel oops or panic logs referencing stmmac_rx or stmmac_rx_zc in the call trace
- NULL pointer dereference faults occurring during periods of high memory pressure on network-active hosts
- Repeated network interface stalls or resets on platforms using the stmmac driver
Detection Strategies
- Monitor dmesg and /var/log/kern.log for NULL pointer dereference signatures originating in drivers/net/ethernet/stmicro/stmmac/
- Correlate kernel crash dumps with concurrent low-memory conditions reported by vmstat or oom-killer activity
- Audit deployed kernel versions against the patched commits in the stable trees
Monitoring Recommendations
- Track RX buffer allocation failures via ethtool -S <iface> counters and netlink statistics
- Alert on sustained MemAvailable drops on embedded systems using stmmac-driven NICs
- Forward kernel crash telemetry to a centralized logging platform for cross-host correlation
How to Mitigate CVE-2026-46110
Immediate Actions Required
- Apply the upstream Linux kernel patches to the stmmac driver on all affected hosts
- Identify embedded devices and SoC platforms shipping the vulnerable driver and prioritize firmware updates
- Implement memory pressure monitoring on systems running stmmac to detect conditions that could trigger the bug
Patch Information
The vulnerability is resolved across multiple stable kernel branches via the following commits: Kernel Patch 0bb05e6, Kernel Patch 4af2e62, Kernel Patch 5c910f77, Kernel Patch 950cb436, and Kernel Patch e1c50b27. The fix adds an explicit dirty descriptor check before advancing cur_rx in both stmmac_rx() and stmmac_rx_zc().
Workarounds
- Reduce memory pressure on affected systems by tuning workloads and increasing available RAM where feasible
- Lower DMA RX ring size to reduce the window in which dirty descriptors can accumulate, accepting potential throughput tradeoffs
- Configure cgroup memory limits and OOM tuning to prevent prolonged allocation failures on network-critical hosts
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
