CVE-2026-23445 (GCVE-0-2026-23445)
Vulnerability from cvelistv5
Published
2026-04-03 15:15
Modified
2026-08-05 12:21
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: igc: fix page fault in XDP TX timestamps handling If an XDP application that requested TX timestamping is shutting down while the link of the interface in use is still up the following kernel splat is reported: [ 883.803618] [ T1554] BUG: unable to handle page fault for address: ffffcfb6200fd008 ... [ 883.803650] [ T1554] Call Trace: [ 883.803652] [ T1554] <TASK> [ 883.803654] [ T1554] igc_ptp_tx_tstamp_event+0xdf/0x160 [igc] [ 883.803660] [ T1554] igc_tsync_interrupt+0x2d5/0x300 [igc] ... During shutdown of the TX ring the xsk_meta pointers are left behind, so that the IRQ handler is trying to touch them. This issue is now being fixed by cleaning up the stale xsk meta data on TX shutdown. TX timestamps on other queues remain unaffected.
References
Impacted products
Vendor Product Version
Linux Linux Version: 15fd021bc4270273d8f4b7f58fdda8a16214a377
Version: 15fd021bc4270273d8f4b7f58fdda8a16214a377
Version: 15fd021bc4270273d8f4b7f58fdda8a16214a377
Version: 15fd021bc4270273d8f4b7f58fdda8a16214a377
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/igc/igc.h",
            "drivers/net/ethernet/intel/igc/igc_main.c",
            "drivers/net/ethernet/intel/igc/igc_ptp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5e4c90c94eb766d70e30694b7fe66862aabaf24b",
              "status": "affected",
              "version": "15fd021bc4270273d8f4b7f58fdda8a16214a377",
              "versionType": "git"
            },
            {
              "lessThan": "31521c124e6488c4a81658e35199feb75a988d86",
              "status": "affected",
              "version": "15fd021bc4270273d8f4b7f58fdda8a16214a377",
              "versionType": "git"
            },
            {
              "lessThan": "b02fa17d1744d19cd3820bdbf6ec5d85547977bf",
              "status": "affected",
              "version": "15fd021bc4270273d8f4b7f58fdda8a16214a377",
              "versionType": "git"
            },
            {
              "lessThan": "45b33e805bd39f615d9353a7194b2da5281332df",
              "status": "affected",
              "version": "15fd021bc4270273d8f4b7f58fdda8a16214a377",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/igc/igc.h",
            "drivers/net/ethernet/intel/igc/igc_main.c",
            "drivers/net/ethernet/intel/igc/igc_ptp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.20",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.78",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.20",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.10",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nigc: fix page fault in XDP TX timestamps handling\n\nIf an XDP application that requested TX timestamping is shutting down\nwhile the link of the interface in use is still up the following kernel\nsplat is reported:\n\n[  883.803618] [   T1554] BUG: unable to handle page fault for address: ffffcfb6200fd008\n...\n[  883.803650] [   T1554] Call Trace:\n[  883.803652] [   T1554]  \u003cTASK\u003e\n[  883.803654] [   T1554]  igc_ptp_tx_tstamp_event+0xdf/0x160 [igc]\n[  883.803660] [   T1554]  igc_tsync_interrupt+0x2d5/0x300 [igc]\n...\n\nDuring shutdown of the TX ring the xsk_meta pointers are left behind, so\nthat the IRQ handler is trying to touch them.\n\nThis issue is now being fixed by cleaning up the stale xsk meta data on\nTX shutdown. TX timestamps on other queues remain unaffected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached through local AF_XDP socket setup/transmit plus SIOCSHWTSTAMP/ioctl configuration on an igc netdev. Remote network packets alone do not create the stale XSK TX timestamp request or trigger XSK pool teardown.\nAC:L - The attacker controls the relevant sequence: enable TX timestamping, submit an AF_XDP zero-copy packet with TX metadata, and shut down the XDP socket while the link remains up. The timing window is between attacker-controlled TX/shutdown and the hardware timestamp IRQ, and can be retried.\nPR:L - The path requires CAP_NET_RAW for PF_XDP and CAP_NET_ADMIN for hardware timestamp configuration in the target network namespace. These are namespace/container capabilities rather than necessarily init-namespace root, so the highest reasonable scoring is Low privileges.\nUI:N - No victim interaction is required after the attacker has local access and the needed namespace capabilities. The attacker can perform the socket setup, transmit, and shutdown sequence directly.\nS:U - The impact is within the local kernel and its managed networking resources. This is a standard kernel memory-safety/DoS issue, not a VM escape or separate security authority boundary crossing.\nC:H - The bug leaves stale AF_XDP TX metadata and buffer pointers in the igc timestamp request array; the IRQ completion path can dereference/write through those stale pointers after teardown. As a stale-pointer memory corruption/UAF-style condition, exploitation could plausibly lead to broader kernel memory disclosure if converted into code execution.\nI:H - The timestamp completion path can perform a write through stale metadata pointers, and cleanup can touch stale TX buffer state. Under the required conservative kernel scoring, this memory corruption is treated as potentially enabling kernel control-flow or data integrity compromise.\nA:H - The documented failure is a kernel page fault/oops in igc_ptp_tx_tstamp_event after XDP application shutdown. A local attacker can repeatedly trigger the condition, causing high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:21:48.746Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5e4c90c94eb766d70e30694b7fe66862aabaf24b"
        },
        {
          "url": "https://git.kernel.org/stable/c/31521c124e6488c4a81658e35199feb75a988d86"
        },
        {
          "url": "https://git.kernel.org/stable/c/b02fa17d1744d19cd3820bdbf6ec5d85547977bf"
        },
        {
          "url": "https://git.kernel.org/stable/c/45b33e805bd39f615d9353a7194b2da5281332df"
        }
      ],
      "title": "igc: fix page fault in XDP TX timestamps handling",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23445",
    "datePublished": "2026-04-03T15:15:29.194Z",
    "dateReserved": "2026-01-13T15:37:46.019Z",
    "dateUpdated": "2026-08-05T12:21:48.746Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.