Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-93830

net: stmmac: xgmac2: disable RBUE in default RX interrupt mask

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: xgmac2: disable RBUE in default RX interrupt mask Enabling the RX Buffer Unavailable (RBUE) interrupt is counterproductive and can trigger a MAC interrupt storm under heavy RX pressure. When the DMA runs out of RX descriptors it fires RBUE continuously until software refills the ring. However, RBUE is redundant: the normal RX completion interrupt (RIE) already triggers NAPI, which processes completed descriptors and refills the ring, causing the DMA to resume. The RBUE handler itself only sets handle_rx - the same outcome as RIE. On Agilex5 under heavy RX pressure, the MAC interrupt (which includes RBUE) was observed firing 1,821,811,555 times against only 2,618,627 actual RX completions - a ~695x ratio - confirming the severity of the storm. RBUE does not provide OOM recovery. If page_pool is exhausted, stmmac_rx_refill() cannot advance the DMA tail pointer, the DMA stays suspended, and RBUE fires again on the next NAPI completion - a storm with no forward progress. This patch trades that storm for a clean stall with the same RX outcome. Proper OOM recovery is a pre-existing gap outside the scope of this fix. Note: as a consequence of disabling RBUE, the rx_buf_unav_irq ethtool counter will always read 0 on XGMAC2 devices. This behaviour is already inconsistent across DWMAC core versions. Remove RBUE from XGMAC_DMA_INT_DEFAULT_EN and XGMAC_DMA_INT_DEFAULT_RX to prevent the interrupt storm while keeping normal RX handling intact.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • d6ddfacd95c79d43465d4a85dffb1c9beca343a9 to < 8c9d57b5dc098b84631d0b3559c84c499ea2170aaffected
  • d6ddfacd95c79d43465d4a85dffb1c9beca343a9 to < 7a10e54e42a8f73a8d731f5a281fc06bb41b9250affected
  • d6ddfacd95c79d43465d4a85dffb1c9beca343a9 to < 6b3b91433d5f4eae6865cdaa96f40cd67849e1f6affected
  • d6ddfacd95c79d43465d4a85dffb1c9beca343a9 to < 74dbb85a6a254b5fc1f265a6cd61b2ba9d9221d7affected
  • d6ddfacd95c79d43465d4a85dffb1c9beca343a9 to < 0b1a5d3647ce07c27a9fffefc11a8cbf7d7b25ceaffected
  • d6ddfacd95c79d43465d4a85dffb1c9beca343a9 to < 87e2826ed2058747ddf014c082569a46bfadd96baffected
  • d6ddfacd95c79d43465d4a85dffb1c9beca343a9 to < d3265c19b35d036bba327b36b5366bee76b0157caffected

Linux Linux

Default version status: affected

  • 4.19affected
  • 0 to < 4.19unaffected
  • 5.10.271 to ≤ 5.10.*unaffected
  • 5.15.222 to ≤ 5.15.*unaffected
  • 6.1.189 to ≤ 6.1.*unaffected
  • 6.6.158 to ≤ 6.6.*unaffected
  • 6.12.111 to ≤ 6.12.*unaffected
  • 6.18.53 to ≤ 6.18.*unaffected
  • 7.2 to ≤ *unaffected

References