CVE-2026-43371

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43371", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:56.006Z", "datePublished": "2026-05-08T14:21:22.577Z", "dateUpdated": "2026-05-11T22:23:17.582Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:23:17.582Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: macb: Shuffle the tx ring before enabling tx\n\nQuanyang observed that when using an NFS rootfs on an AMD ZynqMp board,\nthe rootfs may take an extended time to recover after a suspend.\nUpon investigation, it was determined that the issue originates from a\nproblem in the macb driver.\n\nAccording to the Zynq UltraScale TRM [1], when transmit is disabled,\nthe transmit buffer queue pointer resets to point to the address\nspecified by the transmit buffer queue base address register.\n\nIn the current implementation, the code merely resets `queue->tx_head`\nand `queue->tx_tail` to '0'. This approach presents several issues:\n\n- Packets already queued in the tx ring are silently lost,\n leading to memory leaks since the associated skbs cannot be released.\n\n- Concurrent write access to `queue->tx_head` and `queue->tx_tail` may\n occur from `macb_tx_poll()` or `macb_start_xmit()` when these values\n are reset to '0'.\n\n- The transmission may become stuck on a packet that has already been sent\n out, with its 'TX_USED' bit set, but has not yet been processed. However,\n due to the manipulation of 'queue->tx_head' and 'queue->tx_tail',\n `macb_tx_poll()` incorrectly assumes there are no packets to handle\n because `queue->tx_head == queue->tx_tail`. This issue is only resolved\n when a new packet is placed at this position. This is the root cause of\n the prolonged recovery time observed for the NFS root filesystem.\n\nTo resolve this issue, shuffle the tx ring and tx skb array so that\nthe first unsent packet is positioned at the start of the tx ring.\nAdditionally, ensure that updates to `queue->tx_head` and\n`queue->tx_tail` are properly protected with the appropriate lock.\n\n[1] https://docs.amd.com/v/u/en-US/ug1085-zynq-ultrascale-trm"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/cadence/macb_main.c"], "versions": [{"version": "d89b8b17057e16fad4564c71160e68ca549c1b42", "lessThan": "c6783bfa31a59f34fe4feb1bdbf67791ef3fb0b7", "status": "affected", "versionType": "git"}, {"version": "ec4445ae9e58aed88561d3d1dfa849b039c7782e", "lessThan": "0a47c3889fcd843c72aa57fa8c4d06f5801fced4", "status": "affected", "versionType": "git"}, {"version": "6e704e89f16fd4a1145756210bc210f14f174f94", "lessThan": "88f974fe118cb4653f029929ecbca7cfe06132ae", "status": "affected", "versionType": "git"}, {"version": "316d9fe71fb18bc9b1dba464fdb68dd201315eba", "lessThan": "58f5d34f88e8f00910b692537f7b2efdb8c3705d", "status": "affected", "versionType": "git"}, {"version": "b3a7aa33ca7d46be513fccf832d3540acfe587d0", "lessThan": "403182e0771b250cfde0fe7e1081d095ceaf8230", "status": "affected", "versionType": "git"}, {"version": "bf9cf80cab81e39701861a42877a28295ade266f", "lessThan": "881a0263d502e1a93ebc13a78254e9ad19520232", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/cadence/macb_main.c"], "versions": [{"version": "6.1.165", "lessThan": "6.1.167", "status": "affected", "versionType": "semver"}, {"version": "6.6.128", "lessThan": "6.6.130", "status": "affected", "versionType": "semver"}, {"version": "6.12.75", "lessThan": "6.12.78", "status": "affected", "versionType": "semver"}, {"version": "6.18.16", "lessThan": "6.18.20", "status": "affected", "versionType": "semver"}, {"version": "6.19.6", "lessThan": "6.19.9", "status": "affected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.165", "versionEndExcluding": "6.1.167"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.128", "versionEndExcluding": "6.6.130"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.75", "versionEndExcluding": "6.12.78"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.16", "versionEndExcluding": "6.18.20"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19.6", "versionEndExcluding": "6.19.9"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/c6783bfa31a59f34fe4feb1bdbf67791ef3fb0b7"}, {"url": "https://git.kernel.org/stable/c/0a47c3889fcd843c72aa57fa8c4d06f5801fced4"}, {"url": "https://git.kernel.org/stable/c/88f974fe118cb4653f029929ecbca7cfe06132ae"}, {"url": "https://git.kernel.org/stable/c/58f5d34f88e8f00910b692537f7b2efdb8c3705d"}, {"url": "https://git.kernel.org/stable/c/403182e0771b250cfde0fe7e1081d095ceaf8230"}, {"url": "https://git.kernel.org/stable/c/881a0263d502e1a93ebc13a78254e9ad19520232"}], "title": "net: macb: Shuffle the tx ring before enabling tx", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/cadence/macb_main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "c6783bfa31a59f34fe4feb1bdbf67791ef3fb0b7", "status": "affected", "version": "d89b8b17057e16fad4564c71160e68ca549c1b42", "versionType": "git"}, {"lessThan": "0a47c3889fcd843c72aa57fa8c4d06f5801fced4", "status": "affected", "version": "ec4445ae9e58aed88561d3d1dfa849b039c7782e", "versionType": "git"}, {"lessThan": "88f974fe118cb4653f029929ecbca7cfe06132ae", "status": "affected", "version": "6e704e89f16fd4a1145756210bc210f14f174f94", "versionType": "git"}, {"lessThan": "58f5d34f88e8f00910b692537f7b2efdb8c3705d", "status": "affected", "version": "316d9fe71fb18bc9b1dba464fdb68dd201315eba", "versionType": "git"}, {"lessThan": "403182e0771b250cfde0fe7e1081d095ceaf8230", "status": "affected", "version": "b3a7aa33ca7d46be513fccf832d3540acfe587d0", "versionType": "git"}, {"lessThan": "881a0263d502e1a93ebc13a78254e9ad19520232", "status": "affected", "version": "bf9cf80cab81e39701861a42877a28295ade266f", "versionType": "git"}]}, {"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/cadence/macb_main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6.1.167", "status": "affected", "version": "6.1.165", "versionType": "semver"}, {"lessThan": "6.6.130", "status": "affected", "version": "6.6.128", "versionType": "semver"}, {"lessThan": "6.12.78", "status": "affected", "version": "6.12.75", "versionType": "semver"}, {"lessThan": "6.18.20", "status": "affected", "version": "6.18.16", "versionType": "semver"}, {"lessThan": "6.19.9", "status": "affected", "version": "6.19.6", "versionType": "semver"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D54E2FD5-7EF9-426A-9AE1-8E8DA970BCC8", "versionEndExcluding": "6.1.167", "versionStartIncluding": "6.1.165", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2099D3D0-97C6-44C5-913D-E616B07A9237", "versionEndExcluding": "6.6.130", "versionStartIncluding": "6.6.128", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "DAB9F88E-FB55-4FDB-966E-E7FC262B2038", "versionEndExcluding": "6.12.78", "versionStartIncluding": "6.12.75", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "234D2F07-A17A-49BE-8B89-9C6756315A38", "versionEndExcluding": "6.18.20", "versionStartIncluding": "6.18.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2CFC1CE8-19E1-4AFC-BF52-43BDD2561EE6", "versionEndExcluding": "6.19.9", "versionStartIncluding": "6.19.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: macb: Shuffle the tx ring before enabling tx\n\nQuanyang observed that when using an NFS rootfs on an AMD ZynqMp board,\nthe rootfs may take an extended time to recover after a suspend.\nUpon investigation, it was determined that the issue originates from a\nproblem in the macb driver.\n\nAccording to the Zynq UltraScale TRM [1], when transmit is disabled,\nthe transmit buffer queue pointer resets to point to the address\nspecified by the transmit buffer queue base address register.\n\nIn the current implementation, the code merely resets `queue->tx_head`\nand `queue->tx_tail` to '0'. This approach presents several issues:\n\n- Packets already queued in the tx ring are silently lost,\n leading to memory leaks since the associated skbs cannot be released.\n\n- Concurrent write access to `queue->tx_head` and `queue->tx_tail` may\n occur from `macb_tx_poll()` or `macb_start_xmit()` when these values\n are reset to '0'.\n\n- The transmission may become stuck on a packet that has already been sent\n out, with its 'TX_USED' bit set, but has not yet been processed. However,\n due to the manipulation of 'queue->tx_head' and 'queue->tx_tail',\n `macb_tx_poll()` incorrectly assumes there are no packets to handle\n because `queue->tx_head == queue->tx_tail`. This issue is only resolved\n when a new packet is placed at this position. This is the root cause of\n the prolonged recovery time observed for the NFS root filesystem.\n\nTo resolve this issue, shuffle the tx ring and tx skb array so that\nthe first unsent packet is positioned at the start of the tx ring.\nAdditionally, ensure that updates to `queue->tx_head` and\n`queue->tx_tail` are properly protected with the appropriate lock.\n\n[1] https://docs.amd.com/v/u/en-US/ug1085-zynq-ultrascale-trm"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: macb: Reorganizar el anillo tx antes de habilitar tx\n\nQuanyang observ\u00f3 que al usar un rootfs NFS en una placa AMD ZynqMp, el rootfs puede tardar un tiempo prolongado en recuperarse despu\u00e9s de una suspensi\u00f3n.\nTras la investigaci\u00f3n, se determin\u00f3 que el problema se origina en un problema en el controlador macb.\n\nSeg\u00fan el TRM Zynq UltraScale [1], cuando la transmisi\u00f3n est\u00e1 deshabilitada, el puntero de la cola del b\u00fafer de transmisi\u00f3n se restablece para apuntar a la direcci\u00f3n especificada por el registro de direcci\u00f3n base de la cola del b\u00fafer de transmisi\u00f3n.\n\nEn la implementaci\u00f3n actual, el c\u00f3digo simplemente restablece \u2019queue -> tx_head\u2019 y \u2019queue -> tx_tail\u2019 a \u20190\u2019. Este enfoque presenta varios problemas:\n\n- Los paquetes ya en cola en el anillo tx se pierden silenciosamente, lo que provoca fugas de memoria ya que los skbs asociados no pueden liberarse.\n\n- Puede ocurrir acceso de escritura concurrente a \u2019queue -> tx_head\u2019 y \u2019queue -> tx_tail\u2019 desde \u2019macb_tx_poll()\u2019 o \u2019macb_start_xmit()\u2019 cuando estos valores se restablecen a \u20190\u2019.\n\n- La transmisi\u00f3n puede quedarse atascada en un paquete que ya ha sido enviado, con su bit \u2019TX_USED\u2019 establecido, pero que a\u00fan no ha sido procesado. Sin embargo, debido a la manipulaci\u00f3n de \u2019queue -> tx_head\u2019 y \u2019queue -> tx_tail\u2019, \u2019macb_tx_poll()\u2019 asume incorrectamente que no hay paquetes que manejar porque \u2019queue -> tx_head == queue -> tx_tail\u2019. Este problema solo se resuelve cuando se coloca un nuevo paquete en esta posici\u00f3n. Esta es la causa ra\u00edz del tiempo de recuperaci\u00f3n prolongado observado para el sistema de archivos ra\u00edz NFS.\n\nPara resolver este problema, reorganice el anillo tx y el array de skb tx para que el primer paquete no enviado se posicione al inicio del anillo tx. Adem\u00e1s, aseg\u00farese de que las actualizaciones a \u2019queue -> tx_head\u2019 y \u2019queue -> tx_tail\u2019 est\u00e9n debidamente protegidas con el bloqueo apropiado.\n\n[1] https://docs.amd.com/v/u/en-US/ug1085-zynq-ultrascale-trm"}], "id": "CVE-2026-43371", "lastModified": "2026-11-11T20:10:00.273", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-05-08T15:16:48.187", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0a47c3889fcd843c72aa57fa8c4d06f5801fced4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/403182e0771b250cfde0fe7e1081d095ceaf8230"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/58f5d34f88e8f00910b692537f7b2efdb8c3705d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/881a0263d502e1a93ebc13a78254e9ad19520232"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/88f974fe118cb4653f029929ecbca7cfe06132ae"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c6783bfa31a59f34fe4feb1bdbf67791ef3fb0b7"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-401"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: net: macb: Shuffle the tx ring before enabling tx", "id": "2468220", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468220"}, "csaw": false, "cwe": "CWE-413", "details": ["A flaw was found in the Linux kernel's macb driver. When the transmit function is disabled, the driver incorrectly resets the transmit queue pointers without properly handling packets already in the queue. This can lead to silent loss of queued packets, memory leaks, and potential race conditions during concurrent access to the queue pointers. The most significant impact is a prolonged system recovery time, effectively causing a Denial of Service (DoS) for affected systems, such as those using an NFS (Network File System) root filesystem after a suspend operation."], "name": "CVE-2026-43371", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-43371\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43371\nhttps://lore.kernel.org/linux-cve-announce/2026050829-CVE-2026-43371-a288@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d89b8b17057e16fad4564c71160e68ca549c1b42,c6783bfa31a59f34fe4feb1bdbf67791ef3fb0b7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ec4445ae9e58aed88561d3d1dfa849b039c7782e,0a47c3889fcd843c72aa57fa8c4d06f5801fced4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6e704e89f16fd4a1145756210bc210f14f174f94,88f974fe118cb4653f029929ecbca7cfe06132ae)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[316d9fe71fb18bc9b1dba464fdb68dd201315eba,58f5d34f88e8f00910b692537f7b2efdb8c3705d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b3a7aa33ca7d46be513fccf832d3540acfe587d0,403182e0771b250cfde0fe7e1081d095ceaf8230)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bf9cf80cab81e39701861a42877a28295ade266f,881a0263d502e1a93ebc13a78254e9ad19520232)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.1.165,6.1.167)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.6.128,6.6.130)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.12.75,6.12.78)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.18.16,6.18.20)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.19.6,6.19.9)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-08T17:00:14.840577+00:00", "updated": "2026-05-15T16:30:03.922928+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}