GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-43173 (GCVE-0-2026-43173)

Vulnerability from cvelistv5 – Published: 2026-05-06 11:27 – Updated: 2026-06-01 16:15
VLAI
Title
net: ethernet: xscale: Check for PTP support properly
Summary
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: xscale: Check for PTP support properly In ixp4xx_get_ts_info() ixp46x_ptp_find() is called unconditionally despite this feature only existing on ixp46x, leading to the following splat from tcpdump: root@OpenWrt:~# tcpdump -vv -X -i eth0 (...) Unable to handle kernel NULL pointer dereference at virtual address 00000238 when read (...) Call trace: ptp_clock_index from ixp46x_ptp_find+0x1c/0x38 ixp46x_ptp_find from ixp4xx_get_ts_info+0x4c/0x64 ixp4xx_get_ts_info from __ethtool_get_ts_info+0x90/0x108 __ethtool_get_ts_info from __dev_ethtool+0xa00/0x2648 __dev_ethtool from dev_ethtool+0x160/0x234 dev_ethtool from dev_ioctl+0x2cc/0x460 dev_ioctl from sock_ioctl+0x1ec/0x524 sock_ioctl from sys_ioctl+0x51c/0xa94 sys_ioctl from ret_fast_syscall+0x0/0x44 (...) Segmentation fault Check for ixp46x in ixp46x_ptp_find() before trying to set up PTP to avoid this. To avoid altering the returned error code from ixp4xx_hwtstamp_set() which before this patch was -EOPNOTSUPP, we return -EOPNOTSUPP from ixp4xx_hwtstamp_set() if ixp46x_ptp_find() fails no matter the error code. The helper function ixp46x_ptp_find() helper returns -ENODEV.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9055a2f591629b952910503e72ddae1371c44bf1 , < 322437972f0a712767f6920ad34aba25f2e9b942 (git)
Affected: 9055a2f591629b952910503e72ddae1371c44bf1 , < 21d1e80d0d6e7d0c3cd8b1e001ed1fa92fb9f3f5 (git)
Affected: 9055a2f591629b952910503e72ddae1371c44bf1 , < 2d74412dfd3621552a394d55cc3dd26a7cbf608e (git)
Affected: 9055a2f591629b952910503e72ddae1371c44bf1 , < cbecebd35909f6cd0f6fb773f0fb73da99e02f8c (git)
Affected: 9055a2f591629b952910503e72ddae1371c44bf1 , < 594163ea88a03bdb412063af50fc7177ef3cbeae (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 6.6.128 , ≤ 6.6.* (semver)
Unaffected: 6.12.75 , ≤ 6.12.* (semver)
Unaffected: 6.18.16 , ≤ 6.18.* (semver)
Unaffected: 6.19.6 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/xscale/ixp4xx_eth.c",
            "drivers/net/ethernet/xscale/ptp_ixp46x.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "322437972f0a712767f6920ad34aba25f2e9b942",
              "status": "affected",
              "version": "9055a2f591629b952910503e72ddae1371c44bf1",
              "versionType": "git"
            },
            {
              "lessThan": "21d1e80d0d6e7d0c3cd8b1e001ed1fa92fb9f3f5",
              "status": "affected",
              "version": "9055a2f591629b952910503e72ddae1371c44bf1",
              "versionType": "git"
            },
            {
              "lessThan": "2d74412dfd3621552a394d55cc3dd26a7cbf608e",
              "status": "affected",
              "version": "9055a2f591629b952910503e72ddae1371c44bf1",
              "versionType": "git"
            },
            {
              "lessThan": "cbecebd35909f6cd0f6fb773f0fb73da99e02f8c",
              "status": "affected",
              "version": "9055a2f591629b952910503e72ddae1371c44bf1",
              "versionType": "git"
            },
            {
              "lessThan": "594163ea88a03bdb412063af50fc7177ef3cbeae",
              "status": "affected",
              "version": "9055a2f591629b952910503e72ddae1371c44bf1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/xscale/ixp4xx_eth.c",
            "drivers/net/ethernet/xscale/ptp_ixp46x.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: xscale: Check for PTP support properly\n\nIn ixp4xx_get_ts_info() ixp46x_ptp_find() is called\nunconditionally despite this feature only existing on\nixp46x, leading to the following splat from tcpdump:\n\nroot@OpenWrt:~# tcpdump -vv -X -i eth0\n(...)\nUnable to handle kernel NULL pointer dereference at virtual address\n  00000238 when read\n(...)\nCall trace:\n ptp_clock_index from ixp46x_ptp_find+0x1c/0x38\n ixp46x_ptp_find from ixp4xx_get_ts_info+0x4c/0x64\n ixp4xx_get_ts_info from __ethtool_get_ts_info+0x90/0x108\n __ethtool_get_ts_info from __dev_ethtool+0xa00/0x2648\n __dev_ethtool from dev_ethtool+0x160/0x234\n dev_ethtool from dev_ioctl+0x2cc/0x460\n dev_ioctl from sock_ioctl+0x1ec/0x524\n sock_ioctl from sys_ioctl+0x51c/0xa94\n sys_ioctl from ret_fast_syscall+0x0/0x44\n (...)\nSegmentation fault\n\nCheck for ixp46x in ixp46x_ptp_find() before trying to set up\nPTP to avoid this.\n\nTo avoid altering the returned error code from ixp4xx_hwtstamp_set()\nwhich before this patch was -EOPNOTSUPP, we return -EOPNOTSUPP\nfrom ixp4xx_hwtstamp_set() if ixp46x_ptp_find() fails no matter\nthe error code. The helper function ixp46x_ptp_find() helper\nreturns -ENODEV."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-01T16:15:27.758Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/322437972f0a712767f6920ad34aba25f2e9b942"
        },
        {
          "url": "https://git.kernel.org/stable/c/21d1e80d0d6e7d0c3cd8b1e001ed1fa92fb9f3f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/2d74412dfd3621552a394d55cc3dd26a7cbf608e"
        },
        {
          "url": "https://git.kernel.org/stable/c/cbecebd35909f6cd0f6fb773f0fb73da99e02f8c"
        },
        {
          "url": "https://git.kernel.org/stable/c/594163ea88a03bdb412063af50fc7177ef3cbeae"
        }
      ],
      "title": "net: ethernet: xscale: Check for PTP support properly",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43173",
    "datePublished": "2026-05-06T11:27:48.097Z",
    "dateReserved": "2026-05-01T14:12:55.991Z",
    "dateUpdated": "2026-06-01T16:15:27.758Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-43173",
      "date": "2026-09-15",
      "epss": "0.00122",
      "percentile": "0.02268"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-43173\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-06T12:16:35.707\",\"lastModified\":\"2026-06-17T10:49:04.330\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: ethernet: xscale: Check for PTP support properly\\n\\nIn ixp4xx_get_ts_info() ixp46x_ptp_find() is called\\nunconditionally despite this feature only existing on\\nixp46x, leading to the following splat from tcpdump:\\n\\nroot@OpenWrt:~# tcpdump -vv -X -i eth0\\n(...)\\nUnable to handle kernel NULL pointer dereference at virtual address\\n  00000238 when read\\n(...)\\nCall trace:\\n ptp_clock_index from ixp46x_ptp_find+0x1c/0x38\\n ixp46x_ptp_find from ixp4xx_get_ts_info+0x4c/0x64\\n ixp4xx_get_ts_info from __ethtool_get_ts_info+0x90/0x108\\n __ethtool_get_ts_info from __dev_ethtool+0xa00/0x2648\\n __dev_ethtool from dev_ethtool+0x160/0x234\\n dev_ethtool from dev_ioctl+0x2cc/0x460\\n dev_ioctl from sock_ioctl+0x1ec/0x524\\n sock_ioctl from sys_ioctl+0x51c/0xa94\\n sys_ioctl from ret_fast_syscall+0x0/0x44\\n (...)\\nSegmentation fault\\n\\nCheck for ixp46x in ixp46x_ptp_find() before trying to set up\\nPTP to avoid this.\\n\\nTo avoid altering the returned error code from ixp4xx_hwtstamp_set()\\nwhich before this patch was -EOPNOTSUPP, we return -EOPNOTSUPP\\nfrom ixp4xx_hwtstamp_set() if ixp46x_ptp_find() fails no matter\\nthe error code. The helper function ixp46x_ptp_find() helper\\nreturns -ENODEV.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/xscale/ixp4xx_eth.c\",\"drivers/net/ethernet/xscale/ptp_ixp46x.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"9055a2f591629b952910503e72ddae1371c44bf1\",\"lessThan\":\"322437972f0a712767f6920ad34aba25f2e9b942\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9055a2f591629b952910503e72ddae1371c44bf1\",\"lessThan\":\"21d1e80d0d6e7d0c3cd8b1e001ed1fa92fb9f3f5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9055a2f591629b952910503e72ddae1371c44bf1\",\"lessThan\":\"2d74412dfd3621552a394d55cc3dd26a7cbf608e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9055a2f591629b952910503e72ddae1371c44bf1\",\"lessThan\":\"cbecebd35909f6cd0f6fb773f0fb73da99e02f8c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9055a2f591629b952910503e72ddae1371c44bf1\",\"lessThan\":\"594163ea88a03bdb412063af50fc7177ef3cbeae\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/xscale/ixp4xx_eth.c\",\"drivers/net/ethernet/xscale/ptp_ixp46x.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.128\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.75\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.16\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.6\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15\",\"versionEndExcluding\":\"5.15.202\",\"matchCriteriaId\":\"B0330CE4-09CE-43EF-A9C8-CD49FFD1DC98\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.165\",\"matchCriteriaId\":\"797C7F46-D0BE-4FB8-A502-C5EF8E6B6654\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.128\",\"matchCriteriaId\":\"851E9353-6C09-4CC9-877E-E09DB164A3C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.75\",\"matchCriteriaId\":\"BCE16369-98ED-41CF-8995-DFDC10B288D2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.16\",\"matchCriteriaId\":\"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.6\",\"matchCriteriaId\":\"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F253B622-8837-4245-BCE5-A7BF8FC76A16\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/21d1e80d0d6e7d0c3cd8b1e001ed1fa92fb9f3f5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2d74412dfd3621552a394d55cc3dd26a7cbf608e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/322437972f0a712767f6920ad34aba25f2e9b942\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/594163ea88a03bdb412063af50fc7177ef3cbeae\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cbecebd35909f6cd0f6fb773f0fb73da99e02f8c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-28T07:35:46+00:00",
      "cve": "CVE-2026-43173",
      "id": "CVE-2026-43173",
      "initial_release_date": "2026-05-06T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: ethernet: xscale: Check for PTP support properly",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43173.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-06-02T01:39:18Z",
      "cve": "CVE-2026-43173",
      "id": "CVE-2026-43173",
      "initial_release_date": "2026-05-07T02:17:27Z",
      "product_status:known_affected": "102",
      "product_status:known_not_affected": "125",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-43173",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-43173.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.