CVE-2026-23122

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23122", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.970Z", "datePublished": "2026-02-14T15:09:52.592Z", "dateUpdated": "2026-11-05T21:23:18.093Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:00:33.309Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nigc: Reduce TSN TX packet buffer from 7KB to 5KB per queue\n\nThe previous 7 KB per queue caused TX unit hangs under heavy\ntimestamping load. Reducing to 5 KB avoids these hangs and matches\nthe TSN recommendation in I225/I226 SW User Manual Section 7.5.4.\n\nThe 8 KB \"freed\" by this change is currently unused. This reduction\nis not expected to impact throughput, as the i226 is PCIe-limited\nfor small TSN packets rather than TX-buffer-limited."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/intel/igc/igc_defines.h"], "versions": [{"version": "0d58cdc902dace2298406b3972def04f55e3d775", "lessThan": "88037973c8ef6032bf84e9955595f8b20bc14c21", "status": "affected", "versionType": "git"}, {"version": "0d58cdc902dace2298406b3972def04f55e3d775", "lessThan": "8ad1b6c1e63d25f5465b7a8aa403bdcee84b86f9", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/intel/igc/igc_defines.h"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.8", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.19"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/88037973c8ef6032bf84e9955595f8b20bc14c21"}, {"url": "https://git.kernel.org/stable/c/8ad1b6c1e63d25f5465b7a8aa403bdcee84b86f9"}], "title": "igc: Reduce TSN TX packet buffer from 7KB to 5KB per queue", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23122", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:19:59.639985Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:23:18.093Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23122", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:19:59.639985Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:20:00.609Z"}}], "cna": {"title": "igc: Reduce TSN TX packet buffer from 7KB to 5KB per queue", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "0d58cdc902dace2298406b3972def04f55e3d775", "lessThan": "88037973c8ef6032bf84e9955595f8b20bc14c21", "versionType": "git"}, {"status": "affected", "version": "0d58cdc902dace2298406b3972def04f55e3d775", "lessThan": "8ad1b6c1e63d25f5465b7a8aa403bdcee84b86f9", "versionType": "git"}], "programFiles": ["drivers/net/ethernet/intel/igc/igc_defines.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"status": "unaffected", "version": "0", "lessThan": "6.16", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.8", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/intel/igc/igc_defines.h"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/88037973c8ef6032bf84e9955595f8b20bc14c21"}, {"url": "https://git.kernel.org/stable/c/8ad1b6c1e63d25f5465b7a8aa403bdcee84b86f9"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nigc: Reduce TSN TX packet buffer from 7KB to 5KB per queue\n\nThe previous 7 KB per queue caused TX unit hangs under heavy\ntimestamping load. Reducing to 5 KB avoids these hangs and matches\nthe TSN recommendation in I225/I226 SW User Manual Section 7.5.4.\n\nThe 8 KB \"freed\" by this change is currently unused. This reduction\nis not expected to impact throughput, as the i226 is PCIe-limited\nfor small TSN packets rather than TX-buffer-limited."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.8", "versionStartIncluding": "6.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19", "versionStartIncluding": "6.16"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:00:33.309Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23122", "state": "PUBLISHED", "dateUpdated": "2026-11-05T21:23:18.093Z", "dateReserved": "2026-01-13T15:37:45.970Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-02-14T15:09:52.592Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/intel/igc/igc_defines.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "88037973c8ef6032bf84e9955595f8b20bc14c21", "status": "affected", "version": "0d58cdc902dace2298406b3972def04f55e3d775", "versionType": "git"}, {"lessThan": "8ad1b6c1e63d25f5465b7a8aa403bdcee84b86f9", "status": "affected", "version": "0d58cdc902dace2298406b3972def04f55e3d775", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/intel/igc/igc_defines.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"lessThan": "6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "467E1359-7F6A-4790-AC45-172024944460", "versionEndExcluding": "6.18.8", "versionStartIncluding": "6.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*", "matchCriteriaId": "17B67AA7-40D6-4AFA-8459-F200F3D7CFD1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*", "matchCriteriaId": "C47E4CC9-C826-4FA9-B014-7FE3D9B318B2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*", "matchCriteriaId": "F71D92C0-C023-48BD-B3B6-70B638EEE298", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*", "matchCriteriaId": "13580667-0A98-40CC-B29F-D12790B91BDB", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*", "matchCriteriaId": "CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*", "matchCriteriaId": "3EF854A1-ABB1-4E93-BE9A-44569EC76C0D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nigc: Reduce TSN TX packet buffer from 7KB to 5KB per queue\n\nThe previous 7 KB per queue caused TX unit hangs under heavy\ntimestamping load. Reducing to 5 KB avoids these hangs and matches\nthe TSN recommendation in I225/I226 SW User Manual Section 7.5.4.\n\nThe 8 KB \"freed\" by this change is currently unused. This reduction\nis not expected to impact throughput, as the i226 is PCIe-limited\nfor small TSN packets rather than TX-buffer-limited."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nigc: Reducir el b\u00fafer de paquetes TX TSN de 7KB a 5KB por cola\n\nLos 7 KB anteriores por cola causaban bloqueos de la unidad TX bajo una carga pesada de marca de tiempo. La reducci\u00f3n a 5 KB evita estos bloqueos y coincide con la recomendaci\u00f3n TSN en la Secci\u00f3n 7.5.4 del Manual de Usuario de SW I225/I226.\n\nLos 8 KB 'liberados' por este cambio actualmente no se utilizan. Esta reducci\u00f3n no se espera que impacte el rendimiento, ya que el i226 est\u00e1 limitado por PCIe para paquetes TSN peque\u00f1os en lugar de estar limitado por el b\u00fafer TX."}], "id": "CVE-2026-23122", "lastModified": "2026-11-05T22:18:03.207", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23122", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T21:19:59.639985Z", "version": "2.0.3"}}]}, "published": "2026-02-14T15:16:07.390", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/88037973c8ef6032bf84e9955595f8b20bc14c21"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8ad1b6c1e63d25f5465b7a8aa403bdcee84b86f9"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: igc: Reduce TSN TX packet buffer from 7KB to 5KB per queue", "id": "2439857", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439857"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2026-23122", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-02-14T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23122\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23122\nhttps://lore.kernel.org/linux-cve-announce/2026021408-CVE-2026-23122-77b9@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0d58cdc902dace2298406b3972def04f55e3d775,88037973c8ef6032bf84e9955595f8b20bc14c21)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0d58cdc902dace2298406b3972def04f55e3d775,8ad1b6c1e63d25f5465b7a8aa403bdcee84b86f9)"}}], "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.8,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.19,*]"}}], "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-18T12:27:06.112881+00:00", "value": {"mitigation_remediation": ["Apply a kernel update that contains the TSN TX buffer reduction, such as Linux kernel 6.19 rc6 or a later stable release.", "If an immediate kernel upgrade is not possible, disable TSN timestamping on the I225/I226 devices or implement traffic shaping to reduce the volume of TSN packets, mitigating the risk of TX unit hangs.", "Set up monitoring on network interfaces for unusually high TSN traffic and configure alerts to detect sudden increases that could trigger the buffer hang."], "summary": {"action": "Patch", "impact": "Denial of Service due to TX unit hang"}, "threat_synthesis": {"affected_systems": "The vulnerability exists in the upstream Linux kernel, particularly in the 6.19 release candidates (rc1 through rc6). Any system running a kernel that includes the older 7\u202fKB TSN transmit buffer implementation\u2014before the patch that reduces it to 5\u202fKB\u2014was affected.\n", "description_and_impact": "A Linux kernel change reduces the TSN transmit packet buffer from 7\u202fKB to 5\u202fKB per queue to prevent frequent TX unit hangs under heavy timestamping load. The previous buffer size caused the hardware to lock up when large volumes of timestamped packets were processed, resulting in a denial\u2011of\u2011service condition for both the affected network device and the host kernel. The fix is purely a stability improvement that does not directly expose the system to arbitrary code execution or data exfiltration but can be exploited by generating excessive TSN traffic to trigger the hang.\n", "risk_and_exploitability": "With a CVSS score of 5.5 the severity is moderate. The EPSS indicates exploitation probability is below 1\u202f% and the flaw is not listed in CISA\u2019s KEV catalog, suggesting it is not actively exploited. The likely attack vector involves an attacker (remote or local with network access) who can send or generate large amounts of TSN\u2011timestamped traffic to force the TX unit into a hung state. The impact would be a slowdown or pause of network traffic for the affected device and a possible kernel lockup if the hang propagates. No additional privileges or access are required beyond the ability to generate TSN traffic on the device\u2019s link."}}}}, "created": "2026-02-16T12:01:43.579747+00:00", "updated": "2026-04-18T12:30:45.477824+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-674"]}