CVE-2026-89596: Linux Kernel forcedeth Buffer Overflow

CVE-2026-89596 is a buffer overflow flaw in the Linux kernel forcedeth driver affecting suspend/resume operations. An off-by-one error causes out-of-bounds memory access during configuration space handling. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-89596 Overview

CVE-2026-89596 is an out-of-bounds array access vulnerability in the Linux kernel forcedeth NVIDIA Ethernet driver. The flaw resides in nv_suspend() and nv_resume(), which walk the non-PCI configuration space using for (i = 0; i <= np->register_size/sizeof(u32); i++). This loop executes one iteration past the end of the saved_config_space[] array. On VER3 devices the stray access reaches memory holding name_rx[], and the kernel performs an MMIO read plus an MMIO writel() one dword past the mapped register window. UBSAN detects the access during suspend and resume cycles, and CONFIG_UBSAN_TRAP=y builds abort the running kernel code.

Critical Impact
A local, low-privileged trigger of system suspend or resume causes an out-of-bounds MMIO write and, on trap-enabled kernels, halts kernel execution.

Affected Products

Linux kernel forcedeth driver (drivers/net/ethernet/nvidia/forcedeth.c)
Systems using NVIDIA MCP-family Ethernet controllers (VER1, VER2, VER3)
Reported on Apple Macmini3,1 (MCP79) during S3 suspend

Discovery Timeline

2026-09-11 - CVE-2026-89596 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89596

Vulnerability Analysis

The vulnerability is a classic off-by-one out-of-bounds access [CWE-193/CWE-125/CWE-787]. saved_config_space is declared as u32 saved_config_space[NV_PCI_REGSZ_MAX/4], and NV_PCI_REGSZ_VER3 equals NV_PCI_REGSZ_MAX (0x604). On VER3 hardware, register_size/sizeof(u32) is exactly the array length, so the loop condition i <= register_size/sizeof(u32) accesses element index 385 in a 385-element array.

The out-of-bounds element overlaps the adjacent char name_rx[IFNAMSIZ + 3] field. Nothing observable is corrupted because nv_request_irq() rewrites name_rx with sprintf() before use. However, the driver also performs an MMIO read on suspend and an MMIO writel() on resume targeting base + 0x604, one dword past the region mapped with ioremap(addr, np->register_size). VER1 and VER2 devices remain inside the array but still issue the stray MMIO access past their window.

Root Cause

The root cause is the use of <= instead of < in the loop bounds. The same off-by-one was fixed in nv_get_regs() by commit ba9aa134287f in 2012, but the suspend and resume paths were missed. A 2013 LKML report by Marc Weber identified the identical issue, but the patch was attached rather than sent inline and never merged.

Attack Vector

Exploitation requires local access and the ability to trigger a suspend or resume cycle on a system loading the forcedeth driver. The vulnerability is exercised automatically during ACPI S3 transitions. On kernels built with CONFIG_UBSAN_TRAP=y, the trap aborts kernel execution during power management, producing a denial-of-service condition. The MMIO write past the mapped range can also produce undefined hardware behavior depending on the platform's memory decode.

The fix replaces <= with < in both loops, saving and restoring exactly register_size bytes. See the upstream commits, including Linux Kernel Commit 0c3f454 and Linux Kernel Commit fc71c6c, for the one-character correction across stable branches.

Detection Methods for CVE-2026-89596

Indicators of Compromise

UBSAN splat containing array-index-out-of-bounds in drivers/net/ethernet/nvidia/forcedeth.c:6225 or :6240
Kernel log message index 385 is out of range for type 'u32 [385]' following an S3 suspend or resume
Unexpected kernel trap or aborted pci_pm_suspend / pci_pm_resume callback on systems using forcedeth

Detection Strategies

Enable CONFIG_UBSAN and CONFIG_UBSAN_BOUNDS on test kernels to surface the out-of-bounds access at runtime
Audit loaded kernel modules with lsmod | grep forcedeth and cross-reference against unpatched kernel versions
Review dmesg and journald output after suspend/resume cycles for UBSAN reports referencing forcedeth line 6225 or 6240

Monitoring Recommendations

Forward kernel logs to a centralized log platform and alert on UBSAN: array-index-out-of-bounds events
Track kernel package versions across the fleet and flag hosts running kernels prior to the fixing stable commits
Monitor power-management failure events and unexpected reboots on NVIDIA MCP-based hardware

How to Mitigate CVE-2026-89596

Immediate Actions Required

Update to a Linux kernel that includes one of the stable commits addressing this issue
On systems that cannot be patched immediately, avoid ACPI S3 suspend cycles on affected hardware
Rebuild custom kernels without CONFIG_UBSAN_TRAP=y if suspend availability is critical prior to patching

Patch Information

The fix replaces i <= np->register_size/sizeof(u32) with i < np->register_size/sizeof(u32) in both nv_suspend() and nv_resume(). Stable kernel commits containing the fix include Linux Kernel Commit 702aa4a, Linux Kernel Commit 9379f85, Linux Kernel Commit 9393f1d, Linux Kernel Commit c4d5953, Linux Kernel Commit c4f196b, and Linux Kernel Commit effd589.

Workarounds

Blacklist the forcedeth module on affected systems and use an alternative Ethernet controller where possible
Disable ACPI S3 sleep on affected hosts through firmware or systemctl mask sleep.target suspend.target
Restrict local access to systems running vulnerable kernels to limit ability to initiate suspend cycles

bash

# Blacklist the forcedeth driver until the patched kernel is deployed
echo 'blacklist forcedeth' | sudo tee /etc/modprobe.d/blacklist-forcedeth.conf
sudo update-initramfs -u
sudo reboot