Vulnerability-Lookup

GHSA-582M-3R7C-4438

Vulnerability from github – Published: 2026-08-27 06:31 – Updated: 2026-08-27 06:31

Details

In the Linux kernel, the following vulnerability has been resolved:

net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG

On the packet reception path, the ID of the MAC Port on which the packet was received, is embedded in the RX DMA Descriptor's metadata. The ID is extracted using the helper function cppi5_desc_get_tags_ids() which fills in the 16-bit Source Tag into the 'port_id' variable. However, it is only the lower 8-bits of the 16-bit Source Tag that represent the MAC Port ID, while the upper 8-bits are Hardware-Reserved and carry an arbitrary value. With the existing logic, sporadic kernel crash is observed due to the subsequent driver code accessing out-of-bound memory because of an invalid port_id.

Hence, fix the port_id extraction logic to use only the lower 8-bits of the Source Tag as the MAC Port ID.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-74737"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-26T15:16:52Z",
    "severity": "CRITICAL"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG\n\nOn the packet reception path, the ID of the MAC Port on which the packet\nwas received, is embedded in the RX DMA Descriptor\u0027s metadata. The ID is\nextracted using the helper function cppi5_desc_get_tags_ids() which fills\nin the 16-bit Source Tag into the \u0027port_id\u0027 variable. However, it is only\nthe lower 8-bits of the 16-bit Source Tag that represent the MAC Port ID,\nwhile the upper 8-bits are Hardware-Reserved and carry an arbitrary value.\nWith the existing logic, sporadic kernel crash is observed due to the\nsubsequent driver code accessing out-of-bound memory because of an invalid\nport_id.\n\nHence, fix the port_id extraction logic to use only the lower 8-bits of the\nSource Tag as the MAC Port ID.",
  "id": "GHSA-582m-3r7c-4438",
  "modified": "2026-08-27T06:31:30Z",
  "published": "2026-08-27T06:31:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74737"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/14fc40bf28390e0ebee6a072457c36b82c614100"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1c0e35ce761131f82062222779d8574849790892"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/36a05d2820077bb3955acb8111e1041d39148037"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/46a8e084a159e638ac2728e96980b65d752d65fd"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/551688b410d3fb0dae7739724422f268cd9446d6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/72e4e3d7efc3b7d85f86abbe8b94f8e45074abe3"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/914e0100df3435bd14d09f397238e891cf9b7dce"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9a220225efd6f58350bbb53fe70bdec08519267f"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-74737 (GCVE-0-2026-74737)

Vulnerability from cvelistv5 – Published: 2026-08-26 14:36 – Updated: 2026-08-27 05:00

Title

net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG

Summary

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG On the packet reception path, the ID of the MAC Port on which the packet was received, is embedded in the RX DMA Descriptor's metadata. The ID is extracted using the helper function cppi5_desc_get_tags_ids() which fills in the 16-bit Source Tag into the 'port_id' variable. However, it is only the lower 8-bits of the 16-bit Source Tag that represent the MAC Port ID, while the upper 8-bits are Hardware-Reserved and carry an arbitrary value. With the existing logic, sporadic kernel crash is observed due to the subsequent driver code accessing out-of-bound memory because of an invalid port_id. Hence, fix the port_id extraction logic to use only the lower 8-bits of the Source Tag as the MAC Port ID.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/14fc40bf28390e0eb…
https://git.kernel.org/stable/c/1c0e35ce761131f82…
https://git.kernel.org/stable/c/9a220225efd6f5835…
https://git.kernel.org/stable/c/551688b410d3fb0da…
https://git.kernel.org/stable/c/46a8e084a159e638a…
https://git.kernel.org/stable/c/72e4e3d7efc3b7d85…
https://git.kernel.org/stable/c/914e0100df3435bd1…
https://git.kernel.org/stable/c/36a05d2820077bb39…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 93a76530316a3d8cc2d82c3deca48424fee92100 , < 14fc40bf28390e0ebee6a072457c36b82c614100 (git) Affected: 93a76530316a3d8cc2d82c3deca48424fee92100 , < 1c0e35ce761131f82062222779d8574849790892 (git) Affected: 93a76530316a3d8cc2d82c3deca48424fee92100 , < 9a220225efd6f58350bbb53fe70bdec08519267f (git) Affected: 93a76530316a3d8cc2d82c3deca48424fee92100 , < 551688b410d3fb0dae7739724422f268cd9446d6 (git) Affected: 93a76530316a3d8cc2d82c3deca48424fee92100 , < 46a8e084a159e638ac2728e96980b65d752d65fd (git) Affected: 93a76530316a3d8cc2d82c3deca48424fee92100 , < 72e4e3d7efc3b7d85f86abbe8b94f8e45074abe3 (git) Affected: 93a76530316a3d8cc2d82c3deca48424fee92100 , < 914e0100df3435bd14d09f397238e891cf9b7dce (git) Affected: 93a76530316a3d8cc2d82c3deca48424fee92100 , < 36a05d2820077bb3955acb8111e1041d39148037 (git)
Linux	Linux	Affected: 5.7 Unaffected: 0 , < 5.7 (semver) Unaffected: 5.10.266 , ≤ 5.10.* (semver) Unaffected: 5.15.217 , ≤ 5.15.* (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/ti/am65-cpsw-nuss.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "14fc40bf28390e0ebee6a072457c36b82c614100",
              "status": "affected",
              "version": "93a76530316a3d8cc2d82c3deca48424fee92100",
              "versionType": "git"
            },
            {
              "lessThan": "1c0e35ce761131f82062222779d8574849790892",
              "status": "affected",
              "version": "93a76530316a3d8cc2d82c3deca48424fee92100",
              "versionType": "git"
            },
            {
              "lessThan": "9a220225efd6f58350bbb53fe70bdec08519267f",
              "status": "affected",
              "version": "93a76530316a3d8cc2d82c3deca48424fee92100",
              "versionType": "git"
            },
            {
              "lessThan": "551688b410d3fb0dae7739724422f268cd9446d6",
              "status": "affected",
              "version": "93a76530316a3d8cc2d82c3deca48424fee92100",
              "versionType": "git"
            },
            {
              "lessThan": "46a8e084a159e638ac2728e96980b65d752d65fd",
              "status": "affected",
              "version": "93a76530316a3d8cc2d82c3deca48424fee92100",
              "versionType": "git"
            },
            {
              "lessThan": "72e4e3d7efc3b7d85f86abbe8b94f8e45074abe3",
              "status": "affected",
              "version": "93a76530316a3d8cc2d82c3deca48424fee92100",
              "versionType": "git"
            },
            {
              "lessThan": "914e0100df3435bd14d09f397238e891cf9b7dce",
              "status": "affected",
              "version": "93a76530316a3d8cc2d82c3deca48424fee92100",
              "versionType": "git"
            },
            {
              "lessThan": "36a05d2820077bb3955acb8111e1041d39148037",
              "status": "affected",
              "version": "93a76530316a3d8cc2d82c3deca48424fee92100",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/ti/am65-cpsw-nuss.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.266",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.153",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.46",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.10",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG\n\nOn the packet reception path, the ID of the MAC Port on which the packet\nwas received, is embedded in the RX DMA Descriptor\u0027s metadata. The ID is\nextracted using the helper function cppi5_desc_get_tags_ids() which fills\nin the 16-bit Source Tag into the \u0027port_id\u0027 variable. However, it is only\nthe lower 8-bits of the 16-bit Source Tag that represent the MAC Port ID,\nwhile the upper 8-bits are Hardware-Reserved and carry an arbitrary value.\nWith the existing logic, sporadic kernel crash is observed due to the\nsubsequent driver code accessing out-of-bound memory because of an invalid\nport_id.\n\nHence, fix the port_id extraction logic to use only the lower 8-bits of the\nSource Tag as the MAC Port ID."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in am65_cpsw_nuss_rx_packets() on the NAPI RX path for TI AM65/J721E CPSW Ethernet; any remote host that can deliver L2 frames to a configured port triggers RX DMA completion and this handler without local access.\nAC:L - An attacker only needs to send Ethernet traffic to drive RX completions; although hardware upper source-tag bits make hits sporadic, sustained transmission reliably provokes the out-of-bounds port lookup without races or victim-specific state.\nPR:N - Exploitation requires no Linux credentials or capabilities\u2014the vulnerable code runs in kernel RX softirq before socket demux or authentication, reachable by any entity that can send frames to the NIC.\nUI:N - Packet reception and NAPI polling are automatic once the interface is up; no victim mount, click, or other local action is needed beyond normal network connectivity to the device.\nS:U - Impact is kernel memory corruption and crash within the host kernel security domain; there is no VM, container, or IOMMU boundary crossover typical of Scope Changed scenarios.\nC:H - Invalid port_id indexes far past the kmalloc\u0027d ports[] array (max eight) via am65_common_get_port(), causing out-of-bounds reads of adjacent kernel objects such as ndev pointers, xdp_prog, and other port fields.\nI:H - The same out-of-bounds port pointer drives writes including ndev stats increments, XDP processing, and skb association on attacker-supplied packet buffers, yielding a memory corruption primitive steerable toward kernel modification.\nA:H - The fix commit documents sporadic kernel oops/panics from out-of-bounds access when hardware source-tag upper bits inflate port_id beyond the small allocated ports array."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T05:00:59.630Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/14fc40bf28390e0ebee6a072457c36b82c614100"
        },
        {
          "url": "https://git.kernel.org/stable/c/1c0e35ce761131f82062222779d8574849790892"
        },
        {
          "url": "https://git.kernel.org/stable/c/9a220225efd6f58350bbb53fe70bdec08519267f"
        },
        {
          "url": "https://git.kernel.org/stable/c/551688b410d3fb0dae7739724422f268cd9446d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/46a8e084a159e638ac2728e96980b65d752d65fd"
        },
        {
          "url": "https://git.kernel.org/stable/c/72e4e3d7efc3b7d85f86abbe8b94f8e45074abe3"
        },
        {
          "url": "https://git.kernel.org/stable/c/914e0100df3435bd14d09f397238e891cf9b7dce"
        },
        {
          "url": "https://git.kernel.org/stable/c/36a05d2820077bb3955acb8111e1041d39148037"
        }
      ],
      "title": "net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74737",
    "datePublished": "2026-08-26T14:36:50.544Z",
    "dateReserved": "2026-08-15T05:44:03.930Z",
    "dateUpdated": "2026-08-27T05:00:59.630Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-582M-3R7C-4438

CVE-2026-74737 (GCVE-0-2026-74737)

Tags

Sightings

Nomenclature