CVE-2026-46110

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net: stmmac: Prevent NULL deref when RX memory exhausted

The CPU receives frames from the MAC through conventional DMA: the CPU

allocates buffers for the MAC, then the MAC fills them and returns

ownership to the CPU. For each hardware RX queue, the CPU and MAC

coordinate through a shared ring array of DMA descriptors: one

descriptor per DMA buffer. Each descriptor includes the buffer's

physical address and a status flag ("OWN") indicating which side owns

the buffer: OWN=0 for CPU, OWN=1 for MAC. The CPU is only allowed to set

the flag and the MAC is only allowed to clear it, and both must move

through the ring in sequence: thus the ring is used for both

"submissions" and "completions."

In the stmmac driver, stmmac_rx() bookmarks its position in the ring

with the `cur_rx` index. The main receive loop in that function checks

for rx_descs[cur_rx].own=0, gives the corresponding buffer to the

network stack (NULLing the p

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References