CVE-2026-53300

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net: enetc: fix NTMP DMA use-after-free issue

The AI-generated review reported a potential DMA use-after-free issue

[1]. If netc_xmit_ntmp_cmd() times out and returns an error, the pending

command is not explicitly aborted, while ntmp_free_data_mem()

unconditionally frees the DMA buffer. If the buffer has already been

reallocated elsewhere, this may lead to silent memory corruption. Because

the hardware eventually processes the pending command and perform a DMA

write of the response to the physical address of the freed buffer.

To resolve this issue, this patch does the following modifications:

1. Convert cbdr->ring_lock from a spinlock to a mutex

The lock was originally a spinlock in case NTMP operations might be

invoked from atomic context. After downstream support for all NTMP

tables, no such usage has materialized. A mutex lock is now required

because the driver now needs to reclaim used BDs and release associa

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References