CVE-2026-64587: Linux Kernel EMAC Race Condition Flaw

CVE-2026-64587 Overview

CVE-2026-64587 is a race condition vulnerability in the Linux kernel's ARC EMAC Ethernet driver (drivers/net/ethernet/arc/emac). The flaw exists in the probe path where devm_request_irq() installs an interrupt handler before the driver quiesces the hardware. Stale or latched interrupt status left by firmware or the bootloader can trigger arc_emac_intr() during teardown, racing with the release of the associated net_device structure. Kernel maintainers resolved the issue by disabling all EMAC interrupt sources and clearing pending status bits before requesting the IRQ.

Critical Impact
Spurious interrupt delivery from leftover hardware state can race with net_device release during probe unwinding, creating a use-after-free condition in kernel context.

Affected Products

Linux kernel builds including the ARC EMAC Ethernet driver
Systems using ARC processors with EMAC networking hardware
Embedded platforms relying on the arc_emac driver during boot

Discovery Timeline

2026-08-06 - CVE-2026-64587 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-64587

Vulnerability Analysis

The ARC EMAC driver registers its interrupt handler through devm_request_irq() during probe. Normal RX/TX interrupt sources are only unmasked later in arc_emac_open(), so under expected conditions the handler observes no interrupt traffic during initialization. Hardware state does not always reflect this assumption. Firmware or the bootloader can leave latched interrupt status bits set before the kernel driver takes ownership of the device.

When the probe function fails after devm_request_irq() has already installed arc_emac_intr(), the devres unwinding path tears down the net_device. If a latched interrupt fires during that window, the handler runs concurrently with the release of driver state it depends on. This produces a race against freed memory in a privileged execution context.

Root Cause

The root cause is an ordering defect in device initialization. The driver requests an IRQ before placing the hardware in a known quiescent state. The fix inverts this order: EMAC interrupt sources are masked and pending status bits are cleared before devm_request_irq() is called. This eliminates the class of stale-interrupt races that can occur during error unwind.

Attack Vector

Exploitation requires a race between hardware interrupt delivery and driver teardown during probe failure. The condition is triggered by pre-existing hardware state rather than by user-supplied input over the network. Practical impact is limited to systems where firmware or a bootloader leaves EMAC interrupts pending, and where the probe path encounters an error after IRQ registration. Successful racing can lead to a kernel use-after-free on the net_device structure. See the upstream patches for the exact code change:

Detection Methods for CVE-2026-64587

Indicators of Compromise

Kernel oops or panic entries referencing arc_emac_intr during early boot or module load
KASAN use-after-free reports naming net_device or arc_emac structures
Unexpected dev_err messages from the ARC EMAC driver during probe failure paths

Detection Strategies

Review kernel logs (dmesg, journalctl -k) on ARC-based platforms for probe failures and spurious IRQ warnings tied to the EMAC driver
Enable KASAN and LOCKDEP on test builds to surface use-after-free and locking anomalies during driver initialization
Compare running kernel commit hashes against the fixed commits (2503d08, 5f29dd5, 6fc7449, 81431da, 8efd5dc, 8f9adb3, abd338d, d0f2386)

Monitoring Recommendations

Aggregate kernel crash telemetry from embedded ARC devices into a central log store for pattern analysis
Alert on repeated boot-time failures on identical hardware SKUs, which suggest a reproducible stale-interrupt condition
Track kernel package versions across the fleet to confirm patched builds are deployed

How to Mitigate CVE-2026-64587

Immediate Actions Required

Update to a Linux kernel version that includes the upstream fix commits listed in the NVD references
Rebuild and redeploy custom kernels for ARC-based embedded systems using the patched arc_emac driver
Audit bootloader and firmware configurations that may leave EMAC interrupt status bits latched before kernel handoff

Patch Information

The fix places the EMAC device into a quiescent state before installing the interrupt handler. It disables all EMAC interrupt sources and clears any pending EMAC interrupt status bits prior to devm_request_irq(). The change is contained to the ARC EMAC driver and is hardware-focused. Refer to the stable tree commits: 2503d08, 5f29dd5, 6fc7449, 81431da, 8efd5dc, 8f9adb3, abd338d, and d0f2386.

Workarounds

Where feasible, adjust bootloader or firmware code to mask EMAC interrupts and clear status before jumping to the kernel
Disable the arc_emac driver module on systems that do not require ARC EMAC networking until patched kernels are deployed
Restrict physical and administrative access to affected embedded devices while patching is scheduled