GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-46110 (GCVE-0-2026-46110)

Vulnerability from cvelistv5 – Published: 2026-05-28 09:35 – Updated: 2026-08-05 12:29
VLAI
Title
net: stmmac: Prevent NULL deref when RX memory exhausted
Summary
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: Prevent NULL deref when RX memory exhausted The CPU receives frames from the MAC through conventional DMA: the CPU allocates buffers for the MAC, then the MAC fills them and returns ownership to the CPU. For each hardware RX queue, the CPU and MAC coordinate through a shared ring array of DMA descriptors: one descriptor per DMA buffer. Each descriptor includes the buffer's physical address and a status flag ("OWN") indicating which side owns the buffer: OWN=0 for CPU, OWN=1 for MAC. The CPU is only allowed to set the flag and the MAC is only allowed to clear it, and both must move through the ring in sequence: thus the ring is used for both "submissions" and "completions." In the stmmac driver, stmmac_rx() bookmarks its position in the ring with the `cur_rx` index. The main receive loop in that function checks for rx_descs[cur_rx].own=0, gives the corresponding buffer to the network stack (NULLing the pointer), and increments `cur_rx` modulo the ring size. After the loop exits, stmmac_rx_refill(), which bookmarks its position with `dirty_rx`, allocates fresh buffers and rearms the descriptors (setting OWN=1). If it fails any allocation, it simply stops early (leaving OWN=0) and will retry where it left off when next called. This means descriptors have a three-stage lifecycle (terms my own): - `empty` (OWN=1, buffer valid) - `full` (OWN=0, buffer valid and populated) - `dirty` (OWN=0, buffer NULL) But because stmmac_rx() only checks OWN, it confuses `full`/`dirty`. In the past (see 'Fixes:'), there was a bug where the loop could cycle `cur_rx` all the way back to the first descriptor it dirtied, resulting in a NULL dereference when mistaken for `full`. The aforementioned commit resolved that *specific* failure by capping the loop's iteration limit at `dma_rx_size - 1`, but this is only a partial fix: if the previous stmmac_rx_refill() didn't complete, then there are leftover `dirty` descriptors that the loop might encounter without needing to cycle fully around. The current code therefore panics (see 'Closes:') when stmmac_rx_refill() is memory-starved long enough for `cur_rx` to catch up to `dirty_rx`. Fix this by explicitly checking, before advancing `cur_rx`, if the next entry is dirty; exit the loop if so. This prevents processing of the final, used descriptor until stmmac_rx_refill() succeeds, but fully prevents the `cur_rx == dirty_rx` ambiguity as the previous bugfix intended: so remove the clamp as well. Since stmmac_rx_zc() is a copy-paste-and-tweak of stmmac_rx() and the code structure is identical, any fix to stmmac_rx() will also need a corresponding fix for stmmac_rx_zc(). Therefore, apply the same check there. In stmmac_rx() (not stmmac_rx_zc()), a related bug remains: after the MAC sets OWN=0 on the final descriptor, it will be unable to send any further DMA-complete IRQs until it's given more `empty` descriptors. Currently, the driver simply *hopes* that the next stmmac_rx_refill() succeeds, risking an indefinite stall of the receive process if not. But this is not a regression, so it can be addressed in a future change.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7414a28de1b3b028714859078c00a874f9feff52 , < fdeb95b1fc7de25c9362990efb9996a8d761055c (git)
Affected: 779334e59850f863bf34665e0ff0b6faf126873b , < e1c50b273298c7cd9b08b113e7a7598b531a02f5 (git)
Affected: b6cb4541853c7ee512111b0e7ddf3cb66c99c137 , < 5c910f7708e3c507b037ca91ca5b09f8cfe71e65 (git)
Affected: b6cb4541853c7ee512111b0e7ddf3cb66c99c137 , < 4af2e62cbcda575a174acd230c3f3a208135e16d (git)
Affected: b6cb4541853c7ee512111b0e7ddf3cb66c99c137 , < 950cb436165aad0f8f2cd49da3cd07677465bcde (git)
Affected: b6cb4541853c7ee512111b0e7ddf3cb66c99c137 , < 0bb05e6adfa99a2ea1fee1125cc0953409f83ed8 (git)
Affected: b435b4573240b5530830a1a60e005c6fcfd928a0 (git)
Affected: 6.1.64 , < 6.1.176 (semver)
Affected: 6.6.3 , < 6.6.140 (semver)
Affected: 6.5.13 , < 6.6 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.7
Unaffected: 0 , < 6.7 (semver)
Unaffected: 6.1.176 , ≤ 6.1.* (semver)
Unaffected: 6.6.140 , ≤ 6.6.* (semver)
Unaffected: 6.12.88 , ≤ 6.12.* (semver)
Unaffected: 6.18.30 , ≤ 6.18.* (semver)
Unaffected: 7.0.7 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fdeb95b1fc7de25c9362990efb9996a8d761055c",
              "status": "affected",
              "version": "7414a28de1b3b028714859078c00a874f9feff52",
              "versionType": "git"
            },
            {
              "lessThan": "e1c50b273298c7cd9b08b113e7a7598b531a02f5",
              "status": "affected",
              "version": "779334e59850f863bf34665e0ff0b6faf126873b",
              "versionType": "git"
            },
            {
              "lessThan": "5c910f7708e3c507b037ca91ca5b09f8cfe71e65",
              "status": "affected",
              "version": "b6cb4541853c7ee512111b0e7ddf3cb66c99c137",
              "versionType": "git"
            },
            {
              "lessThan": "4af2e62cbcda575a174acd230c3f3a208135e16d",
              "status": "affected",
              "version": "b6cb4541853c7ee512111b0e7ddf3cb66c99c137",
              "versionType": "git"
            },
            {
              "lessThan": "950cb436165aad0f8f2cd49da3cd07677465bcde",
              "status": "affected",
              "version": "b6cb4541853c7ee512111b0e7ddf3cb66c99c137",
              "versionType": "git"
            },
            {
              "lessThan": "0bb05e6adfa99a2ea1fee1125cc0953409f83ed8",
              "status": "affected",
              "version": "b6cb4541853c7ee512111b0e7ddf3cb66c99c137",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b435b4573240b5530830a1a60e005c6fcfd928a0",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.176",
              "status": "affected",
              "version": "6.1.64",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.140",
              "status": "affected",
              "version": "6.6.3",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6",
              "status": "affected",
              "version": "6.5.13",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "6.1.64",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "6.6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.88",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.30",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.7",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: Prevent NULL deref when RX memory exhausted\n\nThe CPU receives frames from the MAC through conventional DMA: the CPU\nallocates buffers for the MAC, then the MAC fills them and returns\nownership to the CPU. For each hardware RX queue, the CPU and MAC\ncoordinate through a shared ring array of DMA descriptors: one\ndescriptor per DMA buffer. Each descriptor includes the buffer\u0027s\nphysical address and a status flag (\"OWN\") indicating which side owns\nthe buffer: OWN=0 for CPU, OWN=1 for MAC. The CPU is only allowed to set\nthe flag and the MAC is only allowed to clear it, and both must move\nthrough the ring in sequence: thus the ring is used for both\n\"submissions\" and \"completions.\"\n\nIn the stmmac driver, stmmac_rx() bookmarks its position in the ring\nwith the `cur_rx` index. The main receive loop in that function checks\nfor rx_descs[cur_rx].own=0, gives the corresponding buffer to the\nnetwork stack (NULLing the pointer), and increments `cur_rx` modulo the\nring size. After the loop exits, stmmac_rx_refill(), which bookmarks its\nposition with `dirty_rx`, allocates fresh buffers and rearms the\ndescriptors (setting OWN=1). If it fails any allocation, it simply stops\nearly (leaving OWN=0) and will retry where it left off when next called.\n\nThis means descriptors have a three-stage lifecycle (terms my own):\n- `empty` (OWN=1, buffer valid)\n- `full` (OWN=0, buffer valid and populated)\n- `dirty` (OWN=0, buffer NULL)\n\nBut because stmmac_rx() only checks OWN, it confuses `full`/`dirty`. In\nthe past (see \u0027Fixes:\u0027), there was a bug where the loop could cycle\n`cur_rx` all the way back to the first descriptor it dirtied, resulting\nin a NULL dereference when mistaken for `full`. The aforementioned\ncommit resolved that *specific* failure by capping the loop\u0027s iteration\nlimit at `dma_rx_size - 1`, but this is only a partial fix: if the\nprevious stmmac_rx_refill() didn\u0027t complete, then there are leftover\n`dirty` descriptors that the loop might encounter without needing to\ncycle fully around. The current code therefore panics (see \u0027Closes:\u0027)\nwhen stmmac_rx_refill() is memory-starved long enough for `cur_rx` to\ncatch up to `dirty_rx`.\n\nFix this by explicitly checking, before advancing `cur_rx`, if the next\nentry is dirty; exit the loop if so. This prevents processing of the\nfinal, used descriptor until stmmac_rx_refill() succeeds, but\nfully prevents the `cur_rx == dirty_rx` ambiguity as the previous bugfix\nintended: so remove the clamp as well. Since stmmac_rx_zc() is a\ncopy-paste-and-tweak of stmmac_rx() and the code structure is identical,\nany fix to stmmac_rx() will also need a corresponding fix for\nstmmac_rx_zc(). Therefore, apply the same check there.\n\nIn stmmac_rx() (not stmmac_rx_zc()), a related bug remains: after the\nMAC sets OWN=0 on the final descriptor, it will be unable to send any\nfurther DMA-complete IRQs until it\u0027s given more `empty` descriptors.\nCurrently, the driver simply *hopes* that the next stmmac_rx_refill()\nsucceeds, risking an indefinite stall of the receive process if not. But\nthis is not a regression, so it can be addressed in a future change."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code is the Ethernet MAC driver\u0027s network receive (NAPI) path, driven entirely by incoming frames; stmmac is widely used on internet-facing routers/gateways/embedded SoCs, where a remote attacker flooding traffic drives the RX ring exhaustion and memory pressure that trigger the crash.\nAC:L - The triggering condition (RX buffer allocation failure under memory pressure plus sustained frame reception) is something the attacker can materially induce by flooding a memory-constrained device, so it is reliably reachable rather than a layout the attacker cannot influence.\nPR:N - Triggering only requires sending/flooding network frames to the interface; no authentication or local privilege is needed.\nUI:N - The crash occurs autonomously in the kernel RX path as frames are received; no victim action is required.\nS:U - The fault is a NULL dereference within the kernel itself, affecting only the kernel\u0027s own security authority with no cross-boundary impact.\nC:N - The bug is a dereference of a NULL buffer pointer with no data read back to the attacker, so there is no information disclosure.\nI:N - A NULL pointer dereference provides no memory-write or data-modification primitive.\nA:H - Dereferencing the NULL buf-\u003epage causes a kernel oops/panic, crashing the system and denying availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:29:41.911Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fdeb95b1fc7de25c9362990efb9996a8d761055c"
        },
        {
          "url": "https://git.kernel.org/stable/c/e1c50b273298c7cd9b08b113e7a7598b531a02f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c910f7708e3c507b037ca91ca5b09f8cfe71e65"
        },
        {
          "url": "https://git.kernel.org/stable/c/4af2e62cbcda575a174acd230c3f3a208135e16d"
        },
        {
          "url": "https://git.kernel.org/stable/c/950cb436165aad0f8f2cd49da3cd07677465bcde"
        },
        {
          "url": "https://git.kernel.org/stable/c/0bb05e6adfa99a2ea1fee1125cc0953409f83ed8"
        }
      ],
      "title": "net: stmmac: Prevent NULL deref when RX memory exhausted",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46110",
    "datePublished": "2026-05-28T09:35:18.359Z",
    "dateReserved": "2026-05-13T15:03:33.098Z",
    "dateUpdated": "2026-08-05T12:29:41.911Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-46110",
      "date": "2026-09-16",
      "epss": "0.005",
      "percentile": "0.41614"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-09T14:46:34.000Z",
      "cve": "CVE-2026-46110",
      "id": "msrc_CVE-2026-46110",
      "initial_release_date": "2026-05-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net: stmmac: Prevent NULL deref when RX memory exhausted",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-46110.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-46110\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-28T10:16:26.420\",\"lastModified\":\"2026-06-24T18:28:54.623\",\"vulnStatus\":\"Undergoing Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: stmmac: Prevent NULL deref when RX memory exhausted\\n\\nThe CPU receives frames from the MAC through conventional DMA: the CPU\\nallocates buffers for the MAC, then the MAC fills them and returns\\nownership to the CPU. For each hardware RX queue, the CPU and MAC\\ncoordinate through a shared ring array of DMA descriptors: one\\ndescriptor per DMA buffer. Each descriptor includes the buffer\u0027s\\nphysical address and a status flag (\\\"OWN\\\") indicating which side owns\\nthe buffer: OWN=0 for CPU, OWN=1 for MAC. The CPU is only allowed to set\\nthe flag and the MAC is only allowed to clear it, and both must move\\nthrough the ring in sequence: thus the ring is used for both\\n\\\"submissions\\\" and \\\"completions.\\\"\\n\\nIn the stmmac driver, stmmac_rx() bookmarks its position in the ring\\nwith the `cur_rx` index. The main receive loop in that function checks\\nfor rx_descs[cur_rx].own=0, gives the corresponding buffer to the\\nnetwork stack (NULLing the pointer), and increments `cur_rx` modulo the\\nring size. After the loop exits, stmmac_rx_refill(), which bookmarks its\\nposition with `dirty_rx`, allocates fresh buffers and rearms the\\ndescriptors (setting OWN=1). If it fails any allocation, it simply stops\\nearly (leaving OWN=0) and will retry where it left off when next called.\\n\\nThis means descriptors have a three-stage lifecycle (terms my own):\\n- `empty` (OWN=1, buffer valid)\\n- `full` (OWN=0, buffer valid and populated)\\n- `dirty` (OWN=0, buffer NULL)\\n\\nBut because stmmac_rx() only checks OWN, it confuses `full`/`dirty`. In\\nthe past (see \u0027Fixes:\u0027), there was a bug where the loop could cycle\\n`cur_rx` all the way back to the first descriptor it dirtied, resulting\\nin a NULL dereference when mistaken for `full`. The aforementioned\\ncommit resolved that *specific* failure by capping the loop\u0027s iteration\\nlimit at `dma_rx_size - 1`, but this is only a partial fix: if the\\nprevious stmmac_rx_refill() didn\u0027t complete, then there are leftover\\n`dirty` descriptors that the loop might encounter without needing to\\ncycle fully around. The current code therefore panics (see \u0027Closes:\u0027)\\nwhen stmmac_rx_refill() is memory-starved long enough for `cur_rx` to\\ncatch up to `dirty_rx`.\\n\\nFix this by explicitly checking, before advancing `cur_rx`, if the next\\nentry is dirty; exit the loop if so. This prevents processing of the\\nfinal, used descriptor until stmmac_rx_refill() succeeds, but\\nfully prevents the `cur_rx == dirty_rx` ambiguity as the previous bugfix\\nintended: so remove the clamp as well. Since stmmac_rx_zc() is a\\ncopy-paste-and-tweak of stmmac_rx() and the code structure is identical,\\nany fix to stmmac_rx() will also need a corresponding fix for\\nstmmac_rx_zc(). Therefore, apply the same check there.\\n\\nIn stmmac_rx() (not stmmac_rx_zc()), a related bug remains: after the\\nMAC sets OWN=0 on the final descriptor, it will be unable to send any\\nfurther DMA-complete IRQs until it\u0027s given more `empty` descriptors.\\nCurrently, the driver simply *hopes* that the next stmmac_rx_refill()\\nsucceeds, risking an indefinite stall of the receive process if not. But\\nthis is not a regression, so it can be addressed in a future change.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/stmicro/stmmac/stmmac_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7414a28de1b3b028714859078c00a874f9feff52\",\"lessThan\":\"fdeb95b1fc7de25c9362990efb9996a8d761055c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"779334e59850f863bf34665e0ff0b6faf126873b\",\"lessThan\":\"e1c50b273298c7cd9b08b113e7a7598b531a02f5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b6cb4541853c7ee512111b0e7ddf3cb66c99c137\",\"lessThan\":\"5c910f7708e3c507b037ca91ca5b09f8cfe71e65\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b6cb4541853c7ee512111b0e7ddf3cb66c99c137\",\"lessThan\":\"4af2e62cbcda575a174acd230c3f3a208135e16d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b6cb4541853c7ee512111b0e7ddf3cb66c99c137\",\"lessThan\":\"950cb436165aad0f8f2cd49da3cd07677465bcde\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b6cb4541853c7ee512111b0e7ddf3cb66c99c137\",\"lessThan\":\"0bb05e6adfa99a2ea1fee1125cc0953409f83ed8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b435b4573240b5530830a1a60e005c6fcfd928a0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.1.64\",\"lessThan\":\"6.1.176\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.6.3\",\"lessThan\":\"6.6.140\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.5.13\",\"lessThan\":\"6.6\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/stmicro/stmmac/stmmac_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.176\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.140\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.88\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.30\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.7\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1.64\",\"versionEndExcluding\":\"6.1.176\",\"matchCriteriaId\":\"7D2385BE-AA5B-4108-986E-94FE78869E0B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.5.13\",\"versionEndExcluding\":\"6.6\",\"matchCriteriaId\":\"3B6AC16B-2F1C-4FDF-8F49-09FC11C3F5B0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6.3\",\"versionEndExcluding\":\"6.6.140\",\"matchCriteriaId\":\"5BEAFABA-7E5B-445F-93D8-C490B82429EC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7.1\",\"versionEndExcluding\":\"6.12.88\",\"matchCriteriaId\":\"269B1B34-9934-4742-8224-E11B647B979B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.30\",\"matchCriteriaId\":\"BF39AE08-AE6D-4410-8FBE-76F6BF5BF55B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.0.7\",\"matchCriteriaId\":\"D0893CA7-9AE6-4DFE-AC75-48967D73AD8E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.7:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"62B55B1B-7D3E-499B-9C42-E9F1EF05A54A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.7:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"E31AD4FC-436C-44AB-BCAB-3A0B37F69EE0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.7:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"C56C6E04-4F04-44A3-8DB8-93899903CFCF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.7:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"5C78EDA4-8BE6-42FC-9512-49032D525A55\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.7:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"32F2E5CA-13C6-4601-B530-D465CBF73D1C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.7:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"5ED5AF93-F831-48BC-9545-CCB344E814FC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.7:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"81A7ABCB-0807-4AA2-8F4E-75E38D2E3FD4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.7:rc8:*:*:*:*:*:*\",\"matchCriteriaId\":\"B01471D6-2DB4-4AF2-8BE0-B5082B4B9253\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B1EF7059-E670-45F4-B422-54C40FA86390\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0bb05e6adfa99a2ea1fee1125cc0953409f83ed8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4af2e62cbcda575a174acd230c3f3a208135e16d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5c910f7708e3c507b037ca91ca5b09f8cfe71e65\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/950cb436165aad0f8f2cd49da3cd07677465bcde\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e1c50b273298c7cd9b08b113e7a7598b531a02f5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fdeb95b1fc7de25c9362990efb9996a8d761055c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-28T07:40:53+00:00",
      "cve": "CVE-2026-46110",
      "id": "CVE-2026-46110",
      "initial_release_date": "2026-05-28T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: stmmac: Prevent NULL deref when RX memory exhausted",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46110.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T01:12:24Z",
      "cve": "CVE-2026-46110",
      "id": "CVE-2026-46110",
      "initial_release_date": "2026-05-29T01:17:04Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "424",
      "product_status:known_not_affected": "279",
      "product_status:recommended": "283",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-46110",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-46110.json",
      "version": "21"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.