CVE-2026-46110 (GCVE-0-2026-46110)

Vulnerability from cvelistv5 – Published: 2026-05-28 09:35 – Updated: 2026-06-19 11:59
VLAI
Title
net: stmmac: Prevent NULL deref when RX memory exhausted
Summary
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: Prevent NULL deref when RX memory exhausted The CPU receives frames from the MAC through conventional DMA: the CPU allocates buffers for the MAC, then the MAC fills them and returns ownership to the CPU. For each hardware RX queue, the CPU and MAC coordinate through a shared ring array of DMA descriptors: one descriptor per DMA buffer. Each descriptor includes the buffer's physical address and a status flag ("OWN") indicating which side owns the buffer: OWN=0 for CPU, OWN=1 for MAC. The CPU is only allowed to set the flag and the MAC is only allowed to clear it, and both must move through the ring in sequence: thus the ring is used for both "submissions" and "completions." In the stmmac driver, stmmac_rx() bookmarks its position in the ring with the `cur_rx` index. The main receive loop in that function checks for rx_descs[cur_rx].own=0, gives the corresponding buffer to the network stack (NULLing the pointer), and increments `cur_rx` modulo the ring size. After the loop exits, stmmac_rx_refill(), which bookmarks its position with `dirty_rx`, allocates fresh buffers and rearms the descriptors (setting OWN=1). If it fails any allocation, it simply stops early (leaving OWN=0) and will retry where it left off when next called. This means descriptors have a three-stage lifecycle (terms my own): - `empty` (OWN=1, buffer valid) - `full` (OWN=0, buffer valid and populated) - `dirty` (OWN=0, buffer NULL) But because stmmac_rx() only checks OWN, it confuses `full`/`dirty`. In the past (see 'Fixes:'), there was a bug where the loop could cycle `cur_rx` all the way back to the first descriptor it dirtied, resulting in a NULL dereference when mistaken for `full`. The aforementioned commit resolved that *specific* failure by capping the loop's iteration limit at `dma_rx_size - 1`, but this is only a partial fix: if the previous stmmac_rx_refill() didn't complete, then there are leftover `dirty` descriptors that the loop might encounter without needing to cycle fully around. The current code therefore panics (see 'Closes:') when stmmac_rx_refill() is memory-starved long enough for `cur_rx` to catch up to `dirty_rx`. Fix this by explicitly checking, before advancing `cur_rx`, if the next entry is dirty; exit the loop if so. This prevents processing of the final, used descriptor until stmmac_rx_refill() succeeds, but fully prevents the `cur_rx == dirty_rx` ambiguity as the previous bugfix intended: so remove the clamp as well. Since stmmac_rx_zc() is a copy-paste-and-tweak of stmmac_rx() and the code structure is identical, any fix to stmmac_rx() will also need a corresponding fix for stmmac_rx_zc(). Therefore, apply the same check there. In stmmac_rx() (not stmmac_rx_zc()), a related bug remains: after the MAC sets OWN=0 on the final descriptor, it will be unable to send any further DMA-complete IRQs until it's given more `empty` descriptors. Currently, the driver simply *hopes* that the next stmmac_rx_refill() succeeds, risking an indefinite stall of the receive process if not. But this is not a regression, so it can be addressed in a future change.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 7414a28de1b3b028714859078c00a874f9feff52 , < fdeb95b1fc7de25c9362990efb9996a8d761055c (git)
Affected: 779334e59850f863bf34665e0ff0b6faf126873b , < e1c50b273298c7cd9b08b113e7a7598b531a02f5 (git)
Affected: b6cb4541853c7ee512111b0e7ddf3cb66c99c137 , < 5c910f7708e3c507b037ca91ca5b09f8cfe71e65 (git)
Affected: b6cb4541853c7ee512111b0e7ddf3cb66c99c137 , < 4af2e62cbcda575a174acd230c3f3a208135e16d (git)
Affected: b6cb4541853c7ee512111b0e7ddf3cb66c99c137 , < 950cb436165aad0f8f2cd49da3cd07677465bcde (git)
Affected: b6cb4541853c7ee512111b0e7ddf3cb66c99c137 , < 0bb05e6adfa99a2ea1fee1125cc0953409f83ed8 (git)
Affected: b435b4573240b5530830a1a60e005c6fcfd928a0 (git)
Affected: 6.1.64 , < 6.1.176 (semver)
Affected: 6.6.3 , < 6.6.140 (semver)
Affected: 6.5.13 , < 6.6 (semver)
Create a notification for this product.
Linux Linux Affected: 6.7
Unaffected: 0 , < 6.7 (semver)
Unaffected: 6.1.176 , ≤ 6.1.* (semver)
Unaffected: 6.6.140 , ≤ 6.6.* (semver)
Unaffected: 6.12.88 , ≤ 6.12.* (semver)
Unaffected: 6.18.30 , ≤ 6.18.* (semver)
Unaffected: 7.0.7 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fdeb95b1fc7de25c9362990efb9996a8d761055c",
              "status": "affected",
              "version": "7414a28de1b3b028714859078c00a874f9feff52",
              "versionType": "git"
            },
            {
              "lessThan": "e1c50b273298c7cd9b08b113e7a7598b531a02f5",
              "status": "affected",
              "version": "779334e59850f863bf34665e0ff0b6faf126873b",
              "versionType": "git"
            },
            {
              "lessThan": "5c910f7708e3c507b037ca91ca5b09f8cfe71e65",
              "status": "affected",
              "version": "b6cb4541853c7ee512111b0e7ddf3cb66c99c137",
              "versionType": "git"
            },
            {
              "lessThan": "4af2e62cbcda575a174acd230c3f3a208135e16d",
              "status": "affected",
              "version": "b6cb4541853c7ee512111b0e7ddf3cb66c99c137",
              "versionType": "git"
            },
            {
              "lessThan": "950cb436165aad0f8f2cd49da3cd07677465bcde",
              "status": "affected",
              "version": "b6cb4541853c7ee512111b0e7ddf3cb66c99c137",
              "versionType": "git"
            },
            {
              "lessThan": "0bb05e6adfa99a2ea1fee1125cc0953409f83ed8",
              "status": "affected",
              "version": "b6cb4541853c7ee512111b0e7ddf3cb66c99c137",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b435b4573240b5530830a1a60e005c6fcfd928a0",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.176",
              "status": "affected",
              "version": "6.1.64",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.140",
              "status": "affected",
              "version": "6.6.3",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6",
              "status": "affected",
              "version": "6.5.13",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "6.1.64",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "6.6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.88",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.30",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.7",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: Prevent NULL deref when RX memory exhausted\n\nThe CPU receives frames from the MAC through conventional DMA: the CPU\nallocates buffers for the MAC, then the MAC fills them and returns\nownership to the CPU. For each hardware RX queue, the CPU and MAC\ncoordinate through a shared ring array of DMA descriptors: one\ndescriptor per DMA buffer. Each descriptor includes the buffer\u0027s\nphysical address and a status flag (\"OWN\") indicating which side owns\nthe buffer: OWN=0 for CPU, OWN=1 for MAC. The CPU is only allowed to set\nthe flag and the MAC is only allowed to clear it, and both must move\nthrough the ring in sequence: thus the ring is used for both\n\"submissions\" and \"completions.\"\n\nIn the stmmac driver, stmmac_rx() bookmarks its position in the ring\nwith the `cur_rx` index. The main receive loop in that function checks\nfor rx_descs[cur_rx].own=0, gives the corresponding buffer to the\nnetwork stack (NULLing the pointer), and increments `cur_rx` modulo the\nring size. After the loop exits, stmmac_rx_refill(), which bookmarks its\nposition with `dirty_rx`, allocates fresh buffers and rearms the\ndescriptors (setting OWN=1). If it fails any allocation, it simply stops\nearly (leaving OWN=0) and will retry where it left off when next called.\n\nThis means descriptors have a three-stage lifecycle (terms my own):\n- `empty` (OWN=1, buffer valid)\n- `full` (OWN=0, buffer valid and populated)\n- `dirty` (OWN=0, buffer NULL)\n\nBut because stmmac_rx() only checks OWN, it confuses `full`/`dirty`. In\nthe past (see \u0027Fixes:\u0027), there was a bug where the loop could cycle\n`cur_rx` all the way back to the first descriptor it dirtied, resulting\nin a NULL dereference when mistaken for `full`. The aforementioned\ncommit resolved that *specific* failure by capping the loop\u0027s iteration\nlimit at `dma_rx_size - 1`, but this is only a partial fix: if the\nprevious stmmac_rx_refill() didn\u0027t complete, then there are leftover\n`dirty` descriptors that the loop might encounter without needing to\ncycle fully around. The current code therefore panics (see \u0027Closes:\u0027)\nwhen stmmac_rx_refill() is memory-starved long enough for `cur_rx` to\ncatch up to `dirty_rx`.\n\nFix this by explicitly checking, before advancing `cur_rx`, if the next\nentry is dirty; exit the loop if so. This prevents processing of the\nfinal, used descriptor until stmmac_rx_refill() succeeds, but\nfully prevents the `cur_rx == dirty_rx` ambiguity as the previous bugfix\nintended: so remove the clamp as well. Since stmmac_rx_zc() is a\ncopy-paste-and-tweak of stmmac_rx() and the code structure is identical,\nany fix to stmmac_rx() will also need a corresponding fix for\nstmmac_rx_zc(). Therefore, apply the same check there.\n\nIn stmmac_rx() (not stmmac_rx_zc()), a related bug remains: after the\nMAC sets OWN=0 on the final descriptor, it will be unable to send any\nfurther DMA-complete IRQs until it\u0027s given more `empty` descriptors.\nCurrently, the driver simply *hopes* that the next stmmac_rx_refill()\nsucceeds, risking an indefinite stall of the receive process if not. But\nthis is not a regression, so it can be addressed in a future change."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-19T11:59:33.692Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fdeb95b1fc7de25c9362990efb9996a8d761055c"
        },
        {
          "url": "https://git.kernel.org/stable/c/e1c50b273298c7cd9b08b113e7a7598b531a02f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c910f7708e3c507b037ca91ca5b09f8cfe71e65"
        },
        {
          "url": "https://git.kernel.org/stable/c/4af2e62cbcda575a174acd230c3f3a208135e16d"
        },
        {
          "url": "https://git.kernel.org/stable/c/950cb436165aad0f8f2cd49da3cd07677465bcde"
        },
        {
          "url": "https://git.kernel.org/stable/c/0bb05e6adfa99a2ea1fee1125cc0953409f83ed8"
        }
      ],
      "title": "net: stmmac: Prevent NULL deref when RX memory exhausted",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46110",
    "datePublished": "2026-05-28T09:35:18.359Z",
    "dateReserved": "2026-05-13T15:03:33.098Z",
    "dateUpdated": "2026-06-19T11:59:33.692Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-46110",
      "date": "2026-07-14",
      "epss": "0.005",
      "percentile": "0.39337"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-09T14:46:34.000Z",
      "cve": "CVE-2026-46110",
      "id": "msrc_CVE-2026-46110",
      "initial_release_date": "2026-05-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net: stmmac: Prevent NULL deref when RX memory exhausted",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-46110.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-46110\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-28T10:16:26.420\",\"lastModified\":\"2026-06-24T18:28:54.623\",\"vulnStatus\":\"Undergoing Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: stmmac: Prevent NULL deref when RX memory exhausted\\n\\nThe CPU receives frames from the MAC through conventional DMA: the CPU\\nallocates buffers for the MAC, then the MAC fills them and returns\\nownership to the CPU. For each hardware RX queue, the CPU and MAC\\ncoordinate through a shared ring array of DMA descriptors: one\\ndescriptor per DMA buffer. Each descriptor includes the buffer\u0027s\\nphysical address and a status flag (\\\"OWN\\\") indicating which side owns\\nthe buffer: OWN=0 for CPU, OWN=1 for MAC. The CPU is only allowed to set\\nthe flag and the MAC is only allowed to clear it, and both must move\\nthrough the ring in sequence: thus the ring is used for both\\n\\\"submissions\\\" and \\\"completions.\\\"\\n\\nIn the stmmac driver, stmmac_rx() bookmarks its position in the ring\\nwith the `cur_rx` index. The main receive loop in that function checks\\nfor rx_descs[cur_rx].own=0, gives the corresponding buffer to the\\nnetwork stack (NULLing the pointer), and increments `cur_rx` modulo the\\nring size. After the loop exits, stmmac_rx_refill(), which bookmarks its\\nposition with `dirty_rx`, allocates fresh buffers and rearms the\\ndescriptors (setting OWN=1). If it fails any allocation, it simply stops\\nearly (leaving OWN=0) and will retry where it left off when next called.\\n\\nThis means descriptors have a three-stage lifecycle (terms my own):\\n- `empty` (OWN=1, buffer valid)\\n- `full` (OWN=0, buffer valid and populated)\\n- `dirty` (OWN=0, buffer NULL)\\n\\nBut because stmmac_rx() only checks OWN, it confuses `full`/`dirty`. In\\nthe past (see \u0027Fixes:\u0027), there was a bug where the loop could cycle\\n`cur_rx` all the way back to the first descriptor it dirtied, resulting\\nin a NULL dereference when mistaken for `full`. The aforementioned\\ncommit resolved that *specific* failure by capping the loop\u0027s iteration\\nlimit at `dma_rx_size - 1`, but this is only a partial fix: if the\\nprevious stmmac_rx_refill() didn\u0027t complete, then there are leftover\\n`dirty` descriptors that the loop might encounter without needing to\\ncycle fully around. The current code therefore panics (see \u0027Closes:\u0027)\\nwhen stmmac_rx_refill() is memory-starved long enough for `cur_rx` to\\ncatch up to `dirty_rx`.\\n\\nFix this by explicitly checking, before advancing `cur_rx`, if the next\\nentry is dirty; exit the loop if so. This prevents processing of the\\nfinal, used descriptor until stmmac_rx_refill() succeeds, but\\nfully prevents the `cur_rx == dirty_rx` ambiguity as the previous bugfix\\nintended: so remove the clamp as well. Since stmmac_rx_zc() is a\\ncopy-paste-and-tweak of stmmac_rx() and the code structure is identical,\\nany fix to stmmac_rx() will also need a corresponding fix for\\nstmmac_rx_zc(). Therefore, apply the same check there.\\n\\nIn stmmac_rx() (not stmmac_rx_zc()), a related bug remains: after the\\nMAC sets OWN=0 on the final descriptor, it will be unable to send any\\nfurther DMA-complete IRQs until it\u0027s given more `empty` descriptors.\\nCurrently, the driver simply *hopes* that the next stmmac_rx_refill()\\nsucceeds, risking an indefinite stall of the receive process if not. But\\nthis is not a regression, so it can be addressed in a future change.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/stmicro/stmmac/stmmac_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7414a28de1b3b028714859078c00a874f9feff52\",\"lessThan\":\"fdeb95b1fc7de25c9362990efb9996a8d761055c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"779334e59850f863bf34665e0ff0b6faf126873b\",\"lessThan\":\"e1c50b273298c7cd9b08b113e7a7598b531a02f5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b6cb4541853c7ee512111b0e7ddf3cb66c99c137\",\"lessThan\":\"5c910f7708e3c507b037ca91ca5b09f8cfe71e65\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b6cb4541853c7ee512111b0e7ddf3cb66c99c137\",\"lessThan\":\"4af2e62cbcda575a174acd230c3f3a208135e16d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b6cb4541853c7ee512111b0e7ddf3cb66c99c137\",\"lessThan\":\"950cb436165aad0f8f2cd49da3cd07677465bcde\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b6cb4541853c7ee512111b0e7ddf3cb66c99c137\",\"lessThan\":\"0bb05e6adfa99a2ea1fee1125cc0953409f83ed8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b435b4573240b5530830a1a60e005c6fcfd928a0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.1.64\",\"lessThan\":\"6.1.176\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.6.3\",\"lessThan\":\"6.6.140\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.5.13\",\"lessThan\":\"6.6\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/stmicro/stmmac/stmmac_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.176\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.140\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.88\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.30\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.7\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1.64\",\"versionEndExcluding\":\"6.1.176\",\"matchCriteriaId\":\"7D2385BE-AA5B-4108-986E-94FE78869E0B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.5.13\",\"versionEndExcluding\":\"6.6\",\"matchCriteriaId\":\"3B6AC16B-2F1C-4FDF-8F49-09FC11C3F5B0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6.3\",\"versionEndExcluding\":\"6.6.140\",\"matchCriteriaId\":\"5BEAFABA-7E5B-445F-93D8-C490B82429EC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7.1\",\"versionEndExcluding\":\"6.12.88\",\"matchCriteriaId\":\"269B1B34-9934-4742-8224-E11B647B979B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.30\",\"matchCriteriaId\":\"BF39AE08-AE6D-4410-8FBE-76F6BF5BF55B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.0.7\",\"matchCriteriaId\":\"D0893CA7-9AE6-4DFE-AC75-48967D73AD8E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.7:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"62B55B1B-7D3E-499B-9C42-E9F1EF05A54A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.7:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"E31AD4FC-436C-44AB-BCAB-3A0B37F69EE0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.7:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"C56C6E04-4F04-44A3-8DB8-93899903CFCF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.7:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"5C78EDA4-8BE6-42FC-9512-49032D525A55\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.7:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"32F2E5CA-13C6-4601-B530-D465CBF73D1C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.7:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"5ED5AF93-F831-48BC-9545-CCB344E814FC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.7:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"81A7ABCB-0807-4AA2-8F4E-75E38D2E3FD4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.7:rc8:*:*:*:*:*:*\",\"matchCriteriaId\":\"B01471D6-2DB4-4AF2-8BE0-B5082B4B9253\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B1EF7059-E670-45F4-B422-54C40FA86390\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0bb05e6adfa99a2ea1fee1125cc0953409f83ed8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4af2e62cbcda575a174acd230c3f3a208135e16d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5c910f7708e3c507b037ca91ca5b09f8cfe71e65\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/950cb436165aad0f8f2cd49da3cd07677465bcde\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e1c50b273298c7cd9b08b113e7a7598b531a02f5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fdeb95b1fc7de25c9362990efb9996a8d761055c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-28T07:40:53+00:00",
      "cve": "CVE-2026-46110",
      "id": "CVE-2026-46110",
      "initial_release_date": "2026-05-28T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: stmmac: Prevent NULL deref when RX memory exhausted",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46110.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.