Description

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG On the packet reception path, the ID of the MAC Port on which the packet was received, is embedded in the RX DMA Descriptor's metadata. The ID is extracted using the helper function cppi5_desc_get_tags_ids() which fills in the 16-bit Source Tag into the 'port_id' variable. However, it is only the lower 8-bits of the 16-bit Source Tag that represent the MAC Port ID, while the upper 8-bits are Hardware-Reserved and carry an arbitrary value. With the existing logic, sporadic kernel crash is observed due to the subsequent driver code accessing out-of-bound memory because of an invalid port_id. Hence, fix the port_id extraction logic to use only the lower 8-bits of the Source Tag as the MAC Port ID.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-26T15:16:52.313Z",
  "pubdate": "2026-08-26T15:16:52.313Z",
  "executiveSummary": "The Linux kernel driver for the TI AM65-CPSW (am65-cpsw-nuss) contains an out-of-bounds memory access vulnerability triggered by improper field masking in the RX DMA descriptor metadata processing.\nThe vulnerability stems from the extraction of the MAC Port ID from a 16-bit Source Tag, where the driver fails to mask out the upper 8 bits, which contain hardware-reserved values.\nThis logical error leads to the derivation of an invalid, out-of-range port_id, which is subsequently used as an array index or pointer offset in the driver's packet reception path.\nThe primary impact is a kernel-level panic, resulting in a denial-of-service (DoS) condition on the affected system.\nAttackers capable of injecting traffic or influencing the packet metadata received by the interface can trigger this crash. No specific authentication is required if the interface is exposed to a network segment where such traffic can be injected.\nSuccessful exploitation requires the hardware to generate a Source Tag where the reserved bits are non-zero, leading to memory corruption or out-of-bounds access during the driver's internal state lookups.",
  "technicalDetails": "The vulnerability exists within the 'net: ethernet: ti: am65-cpsw-nuss' driver, specifically during the handling of RX DMA descriptors within the packet reception lifecycle.\nWhen a packet is received, the MAC Port ID is embedded within the RX DMA Descriptor's metadata. The driver utilizes the helper function 'cppi5_desc_get_tags_ids()' to retrieve this information. The function retrieves a 16-bit Source Tag; however, the architectural specification dictates that only the lower 8 bits (bits 0-7) represent the valid MAC Port ID.\nThe upper 8 bits (bits 8-15) of the Source Tag are designated as Hardware-Reserved and may contain arbitrary, non-zero data. The current implementation of the driver treats the entire 16-bit value as the port_id without applying a bitwise AND mask to isolate the lower byte.\nThe exploitation flow occurs as follows: 1) A packet arrives at the network interface. 2) The hardware populates the RX DMA descriptor with metadata, including a 16-bit Source Tag. 3) The driver invokes 'cppi5_desc_get_tags_ids()', which returns a 16-bit value containing both the Port ID and the residual hardware-reserved bits. 4) The driver proceeds to use this unmasked 'port_id' to index into an internal array or data structure used to track port-specific configurations or statistics. 5) Because the reserved bits contain arbitrary data, the resulting 'port_id' frequently exceeds the bounds of the allocated buffer. 6) The kernel attempts to access memory at an invalid address offset derived from this corrupted index.\nThis out-of-bounds access results in a memory fault, leading to a kernel panic and a system crash. Since the indexing operation is performed in a high-frequency packet processing path, an attacker can reliably trigger this crash by ensuring the system receives packets that cause the hardware to set the reserved bits in the Source Tag.\nThe vulnerability affects the 'am65-cpsw-nuss' component of the Linux kernel. It is a logic error that bypasses standard safety bounds checks because the input to the index calculation is treated as trusted despite containing unpredictable hardware noise."
}