CVE-2026-68120: Linux Kernel rtase Driver DoS Vulnerability

CVE-2026-68120 Overview

CVE-2026-68120 is a vulnerability in the Linux kernel rtase network driver. The hardware performs packet parsing before transmission and expects specific protocol header data. Malformed or truncated IPv4, IPv6, TCP, or UDP headers can cause the hardware parser to stall, resulting in a transmit (TX) hang. The issue also affects UDP packets destined for ports 319 and 320, which trigger additional Precision Time Protocol (PTP) parsing when the transport data is smaller than RTASE_MIN_PAD_LEN. The vulnerability affects availability of the network interface without requiring authentication.

Critical Impact
A remote attacker can send crafted network packets to induce a transmit hang on affected Linux systems, disrupting network connectivity through the rtase driver.

Affected Products

Linux kernel versions containing the rtase Realtek network driver prior to the fixed commits
Systems using Realtek network interface cards handled by the rtase driver
Distributions shipping unpatched Linux kernel builds with rtase enabled

Discovery Timeline

2026-08-10 - CVE-2026-68120 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68120

Vulnerability Analysis

The rtase driver interfaces with Realtek network hardware that performs on-chip packet parsing before transmission. The parser inspects protocol headers to build offload metadata. When the parser encounters headers that are shorter than the minimum length it expects, it stalls waiting for additional bytes that never arrive. This condition halts the transmit queue and prevents further packet transmission on the affected interface.

The hardware performs an additional parsing pass for PTP traffic. UDP packets with destination ports 319 or 320 are treated as PTP event or general messages. When the transport payload is shorter than RTASE_MIN_PAD_LEN, the PTP parser triggers the same TX hang condition. This attack path is reachable over the network without prior authentication.

Root Cause

The root cause is missing input validation in the driver transmit path. The rtase driver did not verify that outbound packets carried protocol headers of sufficient length for the hardware parser. Non-initial IPv4 fragments compound the problem because the hardware does not consult the fragment offset before parsing the expected transport header location, so fragments without transport headers are still subjected to transport parsing.

Attack Vector

An attacker with network reachability to a target host can send crafted packets that arrive at the transmit path after processing, such as through forwarded or reflected traffic, or by inducing responses that carry truncated protocol headers. Packets with incomplete IPv4, IPv6, TCP, or UDP headers, non-initial IPv4 fragments with short transport data, or UDP packets on ports 319/320 with payloads below RTASE_MIN_PAD_LEN can each trigger the parser stall. The kernel fix drops malformed packets before transmission and pads qualifying packets to the minimum length required by the hardware parser.

See the upstream kernel commit for the driver-level workaround implementation.

Detection Methods for CVE-2026-68120

Indicators of Compromise

Sudden loss of transmit capability on interfaces served by the rtase driver while receive continues to function
Kernel log entries referencing rtase transmit timeouts or watchdog resets on the network queue
Recurring network interface resets correlated with inbound traffic on UDP ports 319 or 320
Elevated volumes of malformed IPv4, IPv6, TCP, or UDP packets arriving at affected hosts

Detection Strategies

Monitor kernel ring buffer output via dmesg for rtase TX timeout or queue stall messages
Track network interface counters for tx_errors, tx_dropped, and carrier transitions using ethtool -S and ip -s link
Deploy packet captures at ingress boundaries to identify truncated protocol headers and short PTP packets
Correlate interface stall events with concurrent traffic patterns to identify triggering flows

Monitoring Recommendations

Ingest kernel logs into a centralized log platform and alert on rtase driver errors
Baseline PTP traffic volumes on UDP ports 319/320 and alert on anomalous spikes from untrusted sources
Track transmit queue timeout metrics per interface for hosts running Realtek network hardware

How to Mitigate CVE-2026-68120

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the CVE record to systems running the rtase driver
Inventory hosts with Realtek network interfaces bound to rtase and prioritize kernel updates for exposed systems
Restrict inbound UDP traffic on ports 319 and 320 to trusted PTP sources at the network perimeter
Filter malformed and truncated IPv4/IPv6/TCP/UDP packets at upstream firewalls where feasible

Patch Information

The Linux kernel maintainers have merged the workaround across stable branches. Reference commits are available at commit 0f54f5048615, commit 1c50efa1faf3, commit 4a4f3aa6af20, and commit fe3a7320711e. Update to a kernel release that incorporates these commits and reboot affected hosts.

Workarounds

Where possible, disable the rtase driver and use an alternative network interface until the kernel is patched
Apply ingress access-control lists to drop UDP packets to ports 319/320 from untrusted networks
Enforce upstream packet validation to strip or reject truncated IP and transport headers before they reach affected hosts

bash

# Verify running kernel and rtase driver status
uname -r
lsmod | grep rtase
ethtool -i <interface> | grep driver

# Restrict PTP UDP ports at the host firewall (example using nftables)
nft add rule inet filter input udp dport {319, 320} ip saddr != 10.0.0.0/8 drop