CVE-2026-93830 (GCVE-0-2026-93830)

Vulnerability from cvelistv5 – Published: 2026-09-24 16:03 – Updated: 2026-09-25 12:43
VLAI
Title
net: stmmac: xgmac2: disable RBUE in default RX interrupt mask
Summary
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: xgmac2: disable RBUE in default RX interrupt mask Enabling the RX Buffer Unavailable (RBUE) interrupt is counterproductive and can trigger a MAC interrupt storm under heavy RX pressure. When the DMA runs out of RX descriptors it fires RBUE continuously until software refills the ring. However, RBUE is redundant: the normal RX completion interrupt (RIE) already triggers NAPI, which processes completed descriptors and refills the ring, causing the DMA to resume. The RBUE handler itself only sets handle_rx - the same outcome as RIE. On Agilex5 under heavy RX pressure, the MAC interrupt (which includes RBUE) was observed firing 1,821,811,555 times against only 2,618,627 actual RX completions - a ~695x ratio - confirming the severity of the storm. RBUE does not provide OOM recovery. If page_pool is exhausted, stmmac_rx_refill() cannot advance the DMA tail pointer, the DMA stays suspended, and RBUE fires again on the next NAPI completion - a storm with no forward progress. This patch trades that storm for a clean stall with the same RX outcome. Proper OOM recovery is a pre-existing gap outside the scope of this fix. Note: as a consequence of disabling RBUE, the rx_buf_unav_irq ethtool counter will always read 0 on XGMAC2 devices. This behaviour is already inconsistent across DWMAC core versions. Remove RBUE from XGMAC_DMA_INT_DEFAULT_EN and XGMAC_DMA_INT_DEFAULT_RX to prevent the interrupt storm while keeping normal RX handling intact.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d6ddfacd95c79d43465d4a85dffb1c9beca343a9 , < 0b1a5d3647ce07c27a9fffefc11a8cbf7d7b25ce (git)
Affected: d6ddfacd95c79d43465d4a85dffb1c9beca343a9 , < 87e2826ed2058747ddf014c082569a46bfadd96b (git)
Affected: d6ddfacd95c79d43465d4a85dffb1c9beca343a9 , < d3265c19b35d036bba327b36b5366bee76b0157c (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.19
Unaffected: 0 , < 4.19 (semver)
Unaffected: 6.12.111 , ≤ 6.12.* (semver)
Unaffected: 6.18.53 , ≤ 6.18.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0b1a5d3647ce07c27a9fffefc11a8cbf7d7b25ce",
              "status": "affected",
              "version": "d6ddfacd95c79d43465d4a85dffb1c9beca343a9",
              "versionType": "git"
            },
            {
              "lessThan": "87e2826ed2058747ddf014c082569a46bfadd96b",
              "status": "affected",
              "version": "d6ddfacd95c79d43465d4a85dffb1c9beca343a9",
              "versionType": "git"
            },
            {
              "lessThan": "d3265c19b35d036bba327b36b5366bee76b0157c",
              "status": "affected",
              "version": "d6ddfacd95c79d43465d4a85dffb1c9beca343a9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.19"
            },
            {
              "lessThan": "4.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: xgmac2: disable RBUE in default RX interrupt mask\n\nEnabling the RX Buffer Unavailable (RBUE) interrupt is counterproductive\nand can trigger a MAC interrupt storm under heavy RX pressure. When the\nDMA runs out of RX descriptors it fires RBUE continuously until software\nrefills the ring.\n\nHowever, RBUE is redundant: the normal RX completion interrupt (RIE)\nalready triggers NAPI, which processes completed descriptors and refills\nthe ring, causing the DMA to resume. The RBUE handler itself only sets\nhandle_rx - the same outcome as RIE.\n\nOn Agilex5 under heavy RX pressure, the MAC interrupt (which includes\nRBUE) was observed firing 1,821,811,555 times against only 2,618,627\nactual RX completions - a ~695x ratio - confirming the severity of the\nstorm.\n\nRBUE does not provide OOM recovery. If page_pool is exhausted,\nstmmac_rx_refill() cannot advance the DMA tail pointer, the DMA stays\nsuspended, and RBUE fires again on the next NAPI completion - a storm\nwith no forward progress. This patch trades that storm for a clean\nstall with the same RX outcome. Proper OOM recovery is a pre-existing\ngap outside the scope of this fix.\n\nNote: as a consequence of disabling RBUE, the rx_buf_unav_irq ethtool\ncounter will always read 0 on XGMAC2 devices. This behaviour is already\ninconsistent across DWMAC core versions.\n\nRemove RBUE from XGMAC_DMA_INT_DEFAULT_EN and XGMAC_DMA_INT_DEFAULT_RX\nto prevent the interrupt storm while keeping normal RX handling intact."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Inbound Ethernet frames (IPv4/IPv6 unicast to the host MAC) are DMA\u0027d into the XGMAC2 RX ring; emptying it asserts XGMAC_RBU. With XGMAC_RBUE in XGMAC_DMA_INT_DEFAULT_RX, stmmac_interrupt/stmmac_msi_intr_rx \u2192 stmmac_napi_check \u2192 dwxgmac2_dma_interrupt runs. XGMAC2 is a 10G IP Ethernet MAC (Agilex5, Tegra MGBE, snps,dwxgmac).\nAC:L - A remote flood is enough: DMA_DEFAULT_RX_SIZE is 512, and Agilex5 under heavy RX already produced 1,821,811,555 MAC IRQs versus 2,618,627 completions. The attacker sets arrival rate; no race or layout is required. The worse stall (page_pool_alloc_pages failure in stmmac_rx_refill) is also GFP_ATOMIC exhaustion from that flood.\nPR:N - dwxgmac2_dma_interrupt runs from the XGMAC DMA hardirq (stmmac_interrupt or stmmac_msi_intr_rx) on received frames before any socket, netfilter verdict, or authentication check.\nUI:N - The attacker sends the frames themselves; stmmac_interrupt/stmmac_msi_intr_rx schedules NAPI via stmmac_napi_check with no local user action.\nS:U - The RBUE storm runs in the host kernel ISR/NAPI (stmmac_interrupt, dwxgmac2_dma_interrupt, stmmac_napi_poll_rx); it does not cross a VM, IOMMU, or sandbox boundary.\nC:N - On XGMAC_RBU, dwxgmac2_dma_interrupt only increments x-\u003erx_buf_unav_irq and returns handle_rx so NAPI runs; it does not read or return kernel memory to the sender.\nI:N - The RBU handler does not write attacker-controlled data into kernel objects; it only sets handle_rx. There is no OOB write, UAF, or control-flow hijack.\nA:H - With XGMAC_RBUE armed, RBU reasserts until stmmac_rx_refill advances the RX tail; if page_pool_alloc_pages fails, stmmac_napi_poll_rx\u0027s napi_complete_done path calls dwxgmac2_enable_dma_irq and the IRQ storms with no forward progress (~695x on Agilex5), livelocking the CPU."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T12:43:40.270Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0b1a5d3647ce07c27a9fffefc11a8cbf7d7b25ce"
        },
        {
          "url": "https://git.kernel.org/stable/c/87e2826ed2058747ddf014c082569a46bfadd96b"
        },
        {
          "url": "https://git.kernel.org/stable/c/d3265c19b35d036bba327b36b5366bee76b0157c"
        }
      ],
      "title": "net: stmmac: xgmac2: disable RBUE in default RX interrupt mask",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-93830",
    "datePublished": "2026-09-24T16:03:12.818Z",
    "dateReserved": "2026-09-18T17:59:28.793Z",
    "dateUpdated": "2026-09-25T12:43:40.270Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-93830",
      "date": "2026-09-25",
      "epss": "0.00426",
      "percentile": "0.34244"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "0b1a5d3647ce07c27a9fffefc11a8cbf7d7b25ce",
                    "status": "affected",
                    "version": "d6ddfacd95c79d43465d4a85dffb1c9beca343a9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "87e2826ed2058747ddf014c082569a46bfadd96b",
                    "status": "affected",
                    "version": "d6ddfacd95c79d43465d4a85dffb1c9beca343a9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d3265c19b35d036bba327b36b5366bee76b0157c",
                    "status": "affected",
                    "version": "d6ddfacd95c79d43465d4a85dffb1c9beca343a9",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.19"
                  },
                  {
                    "lessThan": "4.19",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.111",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: xgmac2: disable RBUE in default RX interrupt mask\n\nEnabling the RX Buffer Unavailable (RBUE) interrupt is counterproductive\nand can trigger a MAC interrupt storm under heavy RX pressure. When the\nDMA runs out of RX descriptors it fires RBUE continuously until software\nrefills the ring.\n\nHowever, RBUE is redundant: the normal RX completion interrupt (RIE)\nalready triggers NAPI, which processes completed descriptors and refills\nthe ring, causing the DMA to resume. The RBUE handler itself only sets\nhandle_rx - the same outcome as RIE.\n\nOn Agilex5 under heavy RX pressure, the MAC interrupt (which includes\nRBUE) was observed firing 1,821,811,555 times against only 2,618,627\nactual RX completions - a ~695x ratio - confirming the severity of the\nstorm.\n\nRBUE does not provide OOM recovery. If page_pool is exhausted,\nstmmac_rx_refill() cannot advance the DMA tail pointer, the DMA stays\nsuspended, and RBUE fires again on the next NAPI completion - a storm\nwith no forward progress. This patch trades that storm for a clean\nstall with the same RX outcome. Proper OOM recovery is a pre-existing\ngap outside the scope of this fix.\n\nNote: as a consequence of disabling RBUE, the rx_buf_unav_irq ethtool\ncounter will always read 0 on XGMAC2 devices. This behaviour is already\ninconsistent across DWMAC core versions.\n\nRemove RBUE from XGMAC_DMA_INT_DEFAULT_EN and XGMAC_DMA_INT_DEFAULT_RX\nto prevent the interrupt storm while keeping normal RX handling intact."
          }
        ],
        "id": "CVE-2026-93830",
        "lastModified": "2026-09-25T13:17:23.817",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-24T17:17:16.740",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0b1a5d3647ce07c27a9fffefc11a8cbf7d7b25ce"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/87e2826ed2058747ddf014c082569a46bfadd96b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d3265c19b35d036bba327b36b5366bee76b0157c"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "not set",
      "current_release_date": "2026-09-24T23:46:59Z",
      "cve": "CVE-2026-93830",
      "id": "CVE-2026-93830",
      "initial_release_date": "2026-09-24T23:46:59Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-93830",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-93830.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.