CVE-2026-93830

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-93830", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-18T17:59:28.793Z", "datePublished": "2026-09-24T16:03:12.818Z", "dateUpdated": "2026-10-03T10:58:00.189Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-03T10:58:00.189Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: xgmac2: disable RBUE in default RX interrupt mask\n\nEnabling the RX Buffer Unavailable (RBUE) interrupt is counterproductive\nand can trigger a MAC interrupt storm under heavy RX pressure. When the\nDMA runs out of RX descriptors it fires RBUE continuously until software\nrefills the ring.\n\nHowever, RBUE is redundant: the normal RX completion interrupt (RIE)\nalready triggers NAPI, which processes completed descriptors and refills\nthe ring, causing the DMA to resume. The RBUE handler itself only sets\nhandle_rx - the same outcome as RIE.\n\nOn Agilex5 under heavy RX pressure, the MAC interrupt (which includes\nRBUE) was observed firing 1,821,811,555 times against only 2,618,627\nactual RX completions - a ~695x ratio - confirming the severity of the\nstorm.\n\nRBUE does not provide OOM recovery. If page_pool is exhausted,\nstmmac_rx_refill() cannot advance the DMA tail pointer, the DMA stays\nsuspended, and RBUE fires again on the next NAPI completion - a storm\nwith no forward progress. This patch trades that storm for a clean\nstall with the same RX outcome. Proper OOM recovery is a pre-existing\ngap outside the scope of this fix.\n\nNote: as a consequence of disabling RBUE, the rx_buf_unav_irq ethtool\ncounter will always read 0 on XGMAC2 devices. This behaviour is already\ninconsistent across DWMAC core versions.\n\nRemove RBUE from XGMAC_DMA_INT_DEFAULT_EN and XGMAC_DMA_INT_DEFAULT_RX\nto prevent the interrupt storm while keeping normal RX handling intact."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - Inbound Ethernet frames (IPv4/IPv6 unicast to the host MAC) are DMA'd into the XGMAC2 RX ring; emptying it asserts XGMAC_RBU. With XGMAC_RBUE in XGMAC_DMA_INT_DEFAULT_RX, stmmac_interrupt/stmmac_msi_intr_rx \u2192 stmmac_napi_check \u2192 dwxgmac2_dma_interrupt runs. XGMAC2 is a 10G IP Ethernet MAC (Agilex5, Tegra MGBE, snps,dwxgmac).\nAC:L - A remote flood is enough: DMA_DEFAULT_RX_SIZE is 512, and Agilex5 under heavy RX already produced 1,821,811,555 MAC IRQs versus 2,618,627 completions. The attacker sets arrival rate; no race or layout is required. The worse stall (page_pool_alloc_pages failure in stmmac_rx_refill) is also GFP_ATOMIC exhaustion from that flood.\nPR:N - dwxgmac2_dma_interrupt runs from the XGMAC DMA hardirq (stmmac_interrupt or stmmac_msi_intr_rx) on received frames before any socket, netfilter verdict, or authentication check.\nUI:N - The attacker sends the frames themselves; stmmac_interrupt/stmmac_msi_intr_rx schedules NAPI via stmmac_napi_check with no local user action.\nS:U - The RBUE storm runs in the host kernel ISR/NAPI (stmmac_interrupt, dwxgmac2_dma_interrupt, stmmac_napi_poll_rx); it does not cross a VM, IOMMU, or sandbox boundary.\nC:N - On XGMAC_RBU, dwxgmac2_dma_interrupt only increments x->rx_buf_unav_irq and returns handle_rx so NAPI runs; it does not read or return kernel memory to the sender.\nI:N - The RBU handler does not write attacker-controlled data into kernel objects; it only sets handle_rx. There is no OOB write, UAF, or control-flow hijack.\nA:H - With XGMAC_RBUE armed, RBU reasserts until stmmac_rx_refill advances the RX tail; if page_pool_alloc_pages fails, stmmac_napi_poll_rx's napi_complete_done path calls dwxgmac2_enable_dma_irq and the IRQ storms with no forward progress (~695x on Agilex5), livelocking the CPU."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h"], "versions": [{"version": "d6ddfacd95c79d43465d4a85dffb1c9beca343a9", "lessThan": "8c9d57b5dc098b84631d0b3559c84c499ea2170a", "status": "affected", "versionType": "git"}, {"version": "d6ddfacd95c79d43465d4a85dffb1c9beca343a9", "lessThan": "7a10e54e42a8f73a8d731f5a281fc06bb41b9250", "status": "affected", "versionType": "git"}, {"version": "d6ddfacd95c79d43465d4a85dffb1c9beca343a9", "lessThan": "6b3b91433d5f4eae6865cdaa96f40cd67849e1f6", "status": "affected", "versionType": "git"}, {"version": "d6ddfacd95c79d43465d4a85dffb1c9beca343a9", "lessThan": "74dbb85a6a254b5fc1f265a6cd61b2ba9d9221d7", "status": "affected", "versionType": "git"}, {"version": "d6ddfacd95c79d43465d4a85dffb1c9beca343a9", "lessThan": "0b1a5d3647ce07c27a9fffefc11a8cbf7d7b25ce", "status": "affected", "versionType": "git"}, {"version": "d6ddfacd95c79d43465d4a85dffb1c9beca343a9", "lessThan": "87e2826ed2058747ddf014c082569a46bfadd96b", "status": "affected", "versionType": "git"}, {"version": "d6ddfacd95c79d43465d4a85dffb1c9beca343a9", "lessThan": "d3265c19b35d036bba327b36b5366bee76b0157c", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h"], "versions": [{"version": "4.19", "status": "affected"}, {"version": "0", "lessThan": "4.19", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.10.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/8c9d57b5dc098b84631d0b3559c84c499ea2170a"}, {"url": "https://git.kernel.org/stable/c/7a10e54e42a8f73a8d731f5a281fc06bb41b9250"}, {"url": "https://git.kernel.org/stable/c/6b3b91433d5f4eae6865cdaa96f40cd67849e1f6"}, {"url": "https://git.kernel.org/stable/c/74dbb85a6a254b5fc1f265a6cd61b2ba9d9221d7"}, {"url": "https://git.kernel.org/stable/c/0b1a5d3647ce07c27a9fffefc11a8cbf7d7b25ce"}, {"url": "https://git.kernel.org/stable/c/87e2826ed2058747ddf014c082569a46bfadd96b"}, {"url": "https://git.kernel.org/stable/c/d3265c19b35d036bba327b36b5366bee76b0157c"}], "title": "net: stmmac: xgmac2: disable RBUE in default RX interrupt mask", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "8c9d57b5dc098b84631d0b3559c84c499ea2170a", "status": "affected", "version": "d6ddfacd95c79d43465d4a85dffb1c9beca343a9", "versionType": "git"}, {"lessThan": "7a10e54e42a8f73a8d731f5a281fc06bb41b9250", "status": "affected", "version": "d6ddfacd95c79d43465d4a85dffb1c9beca343a9", "versionType": "git"}, {"lessThan": "6b3b91433d5f4eae6865cdaa96f40cd67849e1f6", "status": "affected", "version": "d6ddfacd95c79d43465d4a85dffb1c9beca343a9", "versionType": "git"}, {"lessThan": "74dbb85a6a254b5fc1f265a6cd61b2ba9d9221d7", "status": "affected", "version": "d6ddfacd95c79d43465d4a85dffb1c9beca343a9", "versionType": "git"}, {"lessThan": "0b1a5d3647ce07c27a9fffefc11a8cbf7d7b25ce", "status": "affected", "version": "d6ddfacd95c79d43465d4a85dffb1c9beca343a9", "versionType": "git"}, {"lessThan": "87e2826ed2058747ddf014c082569a46bfadd96b", "status": "affected", "version": "d6ddfacd95c79d43465d4a85dffb1c9beca343a9", "versionType": "git"}, {"lessThan": "d3265c19b35d036bba327b36b5366bee76b0157c", "status": "affected", "version": "d6ddfacd95c79d43465d4a85dffb1c9beca343a9", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.19"}, {"lessThan": "4.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.271", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: xgmac2: disable RBUE in default RX interrupt mask\n\nEnabling the RX Buffer Unavailable (RBUE) interrupt is counterproductive\nand can trigger a MAC interrupt storm under heavy RX pressure. When the\nDMA runs out of RX descriptors it fires RBUE continuously until software\nrefills the ring.\n\nHowever, RBUE is redundant: the normal RX completion interrupt (RIE)\nalready triggers NAPI, which processes completed descriptors and refills\nthe ring, causing the DMA to resume. The RBUE handler itself only sets\nhandle_rx - the same outcome as RIE.\n\nOn Agilex5 under heavy RX pressure, the MAC interrupt (which includes\nRBUE) was observed firing 1,821,811,555 times against only 2,618,627\nactual RX completions - a ~695x ratio - confirming the severity of the\nstorm.\n\nRBUE does not provide OOM recovery. If page_pool is exhausted,\nstmmac_rx_refill() cannot advance the DMA tail pointer, the DMA stays\nsuspended, and RBUE fires again on the next NAPI completion - a storm\nwith no forward progress. This patch trades that storm for a clean\nstall with the same RX outcome. Proper OOM recovery is a pre-existing\ngap outside the scope of this fix.\n\nNote: as a consequence of disabling RBUE, the rx_buf_unav_irq ethtool\ncounter will always read 0 on XGMAC2 devices. This behaviour is already\ninconsistent across DWMAC core versions.\n\nRemove RBUE from XGMAC_DMA_INT_DEFAULT_EN and XGMAC_DMA_INT_DEFAULT_RX\nto prevent the interrupt storm while keeping normal RX handling intact."}], "id": "CVE-2026-93830", "lastModified": "2026-10-03T11:17:52.673", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-24T17:17:16.740", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0b1a5d3647ce07c27a9fffefc11a8cbf7d7b25ce"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6b3b91433d5f4eae6865cdaa96f40cd67849e1f6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/74dbb85a6a254b5fc1f265a6cd61b2ba9d9221d7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7a10e54e42a8f73a8d731f5a281fc06bb41b9250"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/87e2826ed2058747ddf014c082569a46bfadd96b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8c9d57b5dc098b84631d0b3559c84c499ea2170a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d3265c19b35d036bba327b36b5366bee76b0157c"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net: stmmac: xgmac2: disable RBUE in default RX interrupt mask", "id": "2540518", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540518"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: stmmac: xgmac2: disable RBUE in default RX interrupt mask\nEnabling the RX Buffer Unavailable (RBUE) interrupt is counterproductive\nand can trigger a MAC interrupt storm under heavy RX pressure. When the\nDMA runs out of RX descriptors it fires RBUE continuously until software\nrefills the ring.\nHowever, RBUE is redundant: the normal RX completion interrupt (RIE)\nalready triggers NAPI, which processes completed descriptors and refills\nthe ring, causing the DMA to resume. The RBUE handler itself only sets\nhandle_rx - the same outcome as RIE.\nOn Agilex5 under heavy RX pressure, the MAC interrupt (which includes\nRBUE) was observed firing 1,821,811,555 times against only 2,618,627\nactual RX completions - a ~695x ratio - confirming the severity of the\nstorm.\nRBUE does not provide OOM recovery. If page_pool is exhausted,\nstmmac_rx_refill() cannot advance the DMA tail pointer, the DMA stays\nsuspended, and RBUE fires again on the next NAPI completion - a storm\nwith no forward progress. This patch trades that storm for a clean\nstall with the same RX outcome. Proper OOM recovery is a pre-existing\ngap outside the scope of this fix.\nNote: as a consequence of disabling RBUE, the rx_buf_unav_irq ethtool\ncounter will always read 0 on XGMAC2 devices. This behaviour is already\ninconsistent across DWMAC core versions.\nRemove RBUE from XGMAC_DMA_INT_DEFAULT_EN and XGMAC_DMA_INT_DEFAULT_RX\nto prevent the interrupt storm while keeping normal RX handling intact.", "A flaw was found in the Linux kernel's stmmac network driver. An attacker can cause a Denial of Service (DoS) by sending high volumes of network traffic to an affected system. Under heavy packet load, the network controller exhausts its receive buffers and continuously fires hardware interrupts before software can refill them. This interrupt storm monopolizes processor resources, leading to severe performance degradation or system unresponsiveness."], "name": "CVE-2026-93830", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-93830\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-93830\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93830.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,0b1a5d3647ce07c27a9fffefc11a8cbf7d7b25ce)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,87e2826ed2058747ddf014c082569a46bfadd96b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,d3265c19b35d036bba327b36b5366bee76b0157c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.12.111)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.18.53)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-24T21:15:15.417973+00:00", "updated": "2026-09-26T02:15:03.037956+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-229", "CWE-770"]}