{ "schema_version": "1.6.1", "id": "RPI-CVE-2026-93830", "modified": "2026-10-09T11:39:44Z", "upstream": [ "CVE-2026-93830" ], "published": "2026-09-24T16:08:25Z", "summary": "net: stmmac: xgmac2: disable RBUE in default RX interrupt mask", "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: xgmac2: disable RBUE in default RX interrupt mask\n\nEnabling the RX Buffer Unavailable (RBUE) interrupt is counterproductive\nand can trigger a MAC interrupt storm under heavy RX pressure. When the\nDMA runs out of RX descriptors it fires RBUE continuously until software\nrefills the ring.\n\nHowever, RBUE is redundant: the normal RX completion interrupt (RIE)\nalready triggers NAPI, which processes completed descriptors and refills\nthe ring, causing the DMA to resume. The RBUE handler itself only sets\nhandle_rx - the same outcome as RIE.\n\nOn Agilex5 under heavy RX pressure, the MAC interrupt (which includes\nRBUE) was observed firing 1,821,811,555 times against only 2,618,627\nactual RX completions - a ~695x ratio - confirming the severity of the\nstorm.\n\nRBUE does not provide OOM recovery. If page_pool is exhausted,\nstmmac_rx_refill() cannot advance the DMA tail pointer, the DMA stays\nsuspended, and RBUE fires again on the next NAPI completion - a storm\nwith no forward progress. This patch trades that storm for a clean\nstall with the same RX outcome. Proper OOM recovery is a pre-existing\ngap outside the scope of this fix.\n\nNote: as a consequence of disabling RBUE, the rx_buf_unav_irq ethtool\ncounter will always read 0 on XGMAC2 devices. This behaviour is already\ninconsistent across DWMAC core versions.\n\nRemove RBUE from XGMAC_DMA_INT_DEFAULT_EN and XGMAC_DMA_INT_DEFAULT_RX\nto prevent the interrupt storm while keeping normal RX handling intact.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "affected": [ { "package": { "ecosystem": "Raspberry Pi OS:12", "name": "linux" }, "versions": [ "1:6.1.47-1+rpt4" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.1.0-rpi3-rpi-2712", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v6", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v7", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v8", "binary_version": "1:6.1.47-1+rpt4" } ] }, "database_specific": { "per_version": { "1:6.1.47-1+rpt4": { "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e", "upstream_version": "6.1.47", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.1.189", "compiled_filter": false } } } } ], "references": [ { "type": "ADVISORY", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93830" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/8c9d57b5dc098b84631d0b3559c84c499ea2170a" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/7a10e54e42a8f73a8d731f5a281fc06bb41b9250" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/6b3b91433d5f4eae6865cdaa96f40cd67849e1f6" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/74dbb85a6a254b5fc1f265a6cd61b2ba9d9221d7" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/0b1a5d3647ce07c27a9fffefc11a8cbf7d7b25ce" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/87e2826ed2058747ddf014c082569a46bfadd96b" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/d3265c19b35d036bba327b36b5366bee76b0157c" } ], "database_specific": { "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git", "upstream_modified": "2026-10-03T11:04:09Z", "severity": { "source": "kernel CNA", "cvss_v3_score": 7.5, "cvss_v3_severity": "High", "scenario": "AV:N - Inbound Ethernet frames (IPv4/IPv6 unicast to the host MAC) are DMA'd into the XGMAC2 RX ring; emptying it asserts XGMAC_RBU. With XGMAC_RBUE in XGMAC_DMA_INT_DEFAULT_RX, stmmac_interrupt/stmmac_msi_intr_rx \u2192 stmmac_napi_check \u2192 dwxgmac2_dma_interrupt runs. XGMAC2 is a 10G IP Ethernet MAC (Agilex5, Tegra MGBE, snps,dwxgmac).\nAC:L - A remote flood is enough: DMA_DEFAULT_RX_SIZE is 512, and Agilex5 under heavy RX already produced 1,821,811,555 MAC IRQs versus 2,618,627 completions. The attacker sets arrival rate; no race or layout is required. The worse stall (page_pool_alloc_pages failure in stmmac_rx_refill) is also GFP_ATOMIC exhaustion from that flood.\nPR:N - dwxgmac2_dma_interrupt runs from the XGMAC DMA hardirq (stmmac_interrupt or stmmac_msi_intr_rx) on received frames before any socket, netfilter verdict, or authentication check.\nUI:N - The attacker sends the frames themselves; stmmac_interrupt/stmmac_msi_intr_rx schedules NAPI via stmmac_napi_check with no local user action.\nS:U - The RBUE storm runs in the host kernel ISR/NAPI (stmmac_interrupt, dwxgmac2_dma_interrupt, stmmac_napi_poll_rx); it does not cross a VM, IOMMU, or sandbox boundary.\nC:N - On XGMAC_RBU, dwxgmac2_dma_interrupt only increments x->rx_buf_unav_irq and returns handle_rx so NAPI runs; it does not read or return kernel memory to the sender.\nI:N - The RBU handler does not write attacker-controlled data into kernel objects; it only sets handle_rx. There is no OOB write, UAF, or control-flow hijack.\nA:H - With XGMAC_RBUE armed, RBU reasserts until stmmac_rx_refill advances the RX tail; if page_pool_alloc_pages fails, stmmac_napi_poll_rx's napi_complete_done path calls dwxgmac2_enable_dma_irq and the IRQ storms with no forward progress (~695x on Agilex5), livelocking the CPU." } } }