{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-23445", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:46.019Z", "datePublished": "2026-04-03T15:15:29.194Z", "dateUpdated": "2026-08-05T12:21:48.746Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:21:48.746Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nigc: fix page fault in XDP TX timestamps handling\n\nIf an XDP application that requested TX timestamping is shutting down\nwhile the link of the interface in use is still up the following kernel\nsplat is reported:\n\n[ 883.803618] [ T1554] BUG: unable to handle page fault for address: ffffcfb6200fd008\n...\n[ 883.803650] [ T1554] Call Trace:\n[ 883.803652] [ T1554] \n[ 883.803654] [ T1554] igc_ptp_tx_tstamp_event+0xdf/0x160 [igc]\n[ 883.803660] [ T1554] igc_tsync_interrupt+0x2d5/0x300 [igc]\n...\n\nDuring shutdown of the TX ring the xsk_meta pointers are left behind, so\nthat the IRQ handler is trying to touch them.\n\nThis issue is now being fixed by cleaning up the stale xsk meta data on\nTX shutdown. TX timestamps on other queues remain unaffected." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable path is reached through local AF_XDP socket setup/transmit plus SIOCSHWTSTAMP/ioctl configuration on an igc netdev. Remote network packets alone do not create the stale XSK TX timestamp request or trigger XSK pool teardown.\nAC:L - The attacker controls the relevant sequence: enable TX timestamping, submit an AF_XDP zero-copy packet with TX metadata, and shut down the XDP socket while the link remains up. The timing window is between attacker-controlled TX/shutdown and the hardware timestamp IRQ, and can be retried.\nPR:L - The path requires CAP_NET_RAW for PF_XDP and CAP_NET_ADMIN for hardware timestamp configuration in the target network namespace. These are namespace/container capabilities rather than necessarily init-namespace root, so the highest reasonable scoring is Low privileges.\nUI:N - No victim interaction is required after the attacker has local access and the needed namespace capabilities. The attacker can perform the socket setup, transmit, and shutdown sequence directly.\nS:U - The impact is within the local kernel and its managed networking resources. This is a standard kernel memory-safety/DoS issue, not a VM escape or separate security authority boundary crossing.\nC:H - The bug leaves stale AF_XDP TX metadata and buffer pointers in the igc timestamp request array; the IRQ completion path can dereference/write through those stale pointers after teardown. As a stale-pointer memory corruption/UAF-style condition, exploitation could plausibly lead to broader kernel memory disclosure if converted into code execution.\nI:H - The timestamp completion path can perform a write through stale metadata pointers, and cleanup can touch stale TX buffer state. Under the required conservative kernel scoring, this memory corruption is treated as potentially enabling kernel control-flow or data integrity compromise.\nA:H - The documented failure is a kernel page fault/oops in igc_ptp_tx_tstamp_event after XDP application shutdown. A local attacker can repeatedly trigger the condition, causing high availability impact." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/intel/igc/igc.h", "drivers/net/ethernet/intel/igc/igc_main.c", "drivers/net/ethernet/intel/igc/igc_ptp.c" ], "versions": [ { "version": "15fd021bc4270273d8f4b7f58fdda8a16214a377", "lessThan": "5e4c90c94eb766d70e30694b7fe66862aabaf24b", "status": "affected", "versionType": "git" }, { "version": "15fd021bc4270273d8f4b7f58fdda8a16214a377", "lessThan": "31521c124e6488c4a81658e35199feb75a988d86", "status": "affected", "versionType": "git" }, { "version": "15fd021bc4270273d8f4b7f58fdda8a16214a377", "lessThan": "b02fa17d1744d19cd3820bdbf6ec5d85547977bf", "status": "affected", "versionType": "git" }, { "version": "15fd021bc4270273d8f4b7f58fdda8a16214a377", "lessThan": "45b33e805bd39f615d9353a7194b2da5281332df", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/intel/igc/igc.h", "drivers/net/ethernet/intel/igc/igc_main.c", "drivers/net/ethernet/intel/igc/igc_ptp.c" ], "versions": [ { "version": "6.10", "status": "affected" }, { "version": "0", "lessThan": "6.10", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.78", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.20", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19.10", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.12.78" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.18.20" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.19.10" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/5e4c90c94eb766d70e30694b7fe66862aabaf24b" }, { "url": "https://git.kernel.org/stable/c/31521c124e6488c4a81658e35199feb75a988d86" }, { "url": "https://git.kernel.org/stable/c/b02fa17d1744d19cd3820bdbf6ec5d85547977bf" }, { "url": "https://git.kernel.org/stable/c/45b33e805bd39f615d9353a7194b2da5281332df" } ], "title": "igc: fix page fault in XDP TX timestamps handling", "x_generator": { "engine": "bippy-1.2.0" } } } }