Description

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: xgmac2: disable RBUE in default RX interrupt mask Enabling the RX Buffer Unavailable (RBUE) interrupt is counterproductive and can trigger a MAC interrupt storm under heavy RX pressure. When the DMA runs out of RX descriptors it fires RBUE continuously until software refills the ring. However, RBUE is redundant: the normal RX completion interrupt (RIE) already triggers NAPI, which processes completed descriptors and refills the ring, causing the DMA to resume. The RBUE handler itself only sets handle_rx - the same outcome as RIE. On Agilex5 under heavy RX pressure, the MAC interrupt (which includes RBUE) was observed firing 1,821,811,555 times against only 2,618,627 actual RX completions - a ~695x ratio - confirming the severity of the storm. RBUE does not provide OOM recovery. If page_pool is exhausted, stmmac_rx_refill() cannot advance the DMA tail pointer, the DMA stays suspended, and RBUE fires again on the next NAPI completion - a storm with no forward progress. This patch trades that storm for a clean stall with the same RX outcome. Proper OOM recovery is a pre-existing gap outside the scope of this fix. Note: as a consequence of disabling RBUE, the rx_buf_unav_irq ethtool counter will always read 0 on XGMAC2 devices. This behaviour is already inconsistent across DWMAC core versions. Remove RBUE from XGMAC_DMA_INT_DEFAULT_EN and XGMAC_DMA_INT_DEFAULT_RX to prevent the interrupt storm while keeping normal RX handling intact.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-24T17:17:16.740Z",
  "pubdate": "2026-09-24T17:17:16.740Z",
  "executiveSummary": "This vulnerability involves an interrupt storm condition within the Linux kernel's STMMAC (Synopsys DesignWare Ethernet MAC) driver specifically affecting XGMAC2 hardware.\nThe issue is categorized as an improper resource management/denial-of-service vulnerability triggered by the enablement of the RX Buffer Unavailable (RBUE) interrupt.\nUnder heavy RX pressure, the DMA controller exhausts available RX descriptors, causing the RBUE interrupt to fire continuously. This results in an interrupt storm, consuming significant CPU resources and effectively creating a localized Denial-of-Service (DoS) condition on the host system.\nThe impact is severe due to the amplification ratio observed during high-load scenarios, where millions of unnecessary interrupts are generated for a fraction of actual packet completions.\nNo authentication or privilege escalation is required to trigger this state; it is a side effect of normal network operations under stress.\nThe vulnerability manifests as a system-wide performance degradation or total stall, as the CPU becomes overwhelmed by the interrupt handler throughput.",
  "technicalDetails": "The vulnerability resides in the XGMAC2 DMA interrupt configuration within the Linux kernel's STMMAC driver. The driver enables the RBUE (RX Buffer Unavailable) interrupt, which is intended to signal the CPU when the DMA engine encounters an empty RX descriptor ring.\nThe root cause is a flawed design pattern in the interrupt handling logic: when the DMA runs out of descriptors, it asserts the RBUE interrupt. Because the NAPI polling mechanism (triggered by the normal RX completion interrupt, RIE) already handles descriptor replenishment, the RBUE signal is redundant.\nUnder sustained network pressure, if the DMA ring exhausts, the hardware continuously asserts RBUE. The kernel responds by invoking the interrupt handler repeatedly. Since the underlying cause—a lack of available descriptors—is often not immediately resolved by the interrupt handler (especially under OOM conditions or high load), the interrupt fires again immediately upon completion.\nThis creates an amplification feedback loop. On Agilex5 hardware, researchers observed a ~695x ratio of interrupts to successful packet completions, leading to an interrupt storm that monopolizes the CPU core responsible for processing the MAC interrupts.\nThe attack flow is entirely passive from the perspective of an external network participant. An attacker simply needs to send a sustained stream of incoming traffic that exceeds the driver's ability to refill descriptors. This forces the hardware into the exhaustion state, triggering the storm.\nBecause the RBUE handler does not provide actual Out-Of-Memory (OOM) recovery and merely attempts to invoke standard RX processing, it does not assist in system recovery. Instead, it prevents the system from entering a clean stall or managing the load gracefully.\nThe vulnerability affects XGMAC2-based Ethernet controllers within the STMMAC driver. By removing RBUE from the default interrupt masks (XGMAC_DMA_INT_DEFAULT_EN and XGMAC_DMA_INT_DEFAULT_RX), the driver avoids this infinite loop while maintaining functional RX processing via the RIE mechanism."
}