CVE-2026-64587 (GCVE-0-2026-64587)
Vulnerability from cvelistv5
Published
2026-08-06 07:06
Modified
2026-08-08 15:13
Severity ?
7.0 (High) - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: arc: emac: quiesce interrupts before requesting IRQ Normal RX/TX interrupts are enabled later, in arc_emac_open(), so probe should not see interrupt delivery in the usual case. However, hardware may still present stale or latched interrupt status left by firmware or the bootloader. If probe later unwinds after devm_request_irq() has installed the handler, such a stale interrupt can still reach arc_emac_intr() during teardown and race with release of the associated net_device. Avoid that window by putting the device into a known quiescent state before requesting the IRQ: disable all EMAC interrupt sources and clear any pending EMAC interrupt status bits. This keeps the change hardware-focused and minimal, while preventing spurious IRQ delivery from leftover state.
References
Impacted products
Vendor Product Version
Linux Linux Version: e4f2379db6c6823c5d4a4c2c912df00c65de51d7
Version: e4f2379db6c6823c5d4a4c2c912df00c65de51d7
Version: e4f2379db6c6823c5d4a4c2c912df00c65de51d7
Version: e4f2379db6c6823c5d4a4c2c912df00c65de51d7
Version: e4f2379db6c6823c5d4a4c2c912df00c65de51d7
Version: e4f2379db6c6823c5d4a4c2c912df00c65de51d7
Version: e4f2379db6c6823c5d4a4c2c912df00c65de51d7
Version: e4f2379db6c6823c5d4a4c2c912df00c65de51d7
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/arc/emac_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "abd338da658d7faa8e26cfefc8f83f0066707564",
              "status": "affected",
              "version": "e4f2379db6c6823c5d4a4c2c912df00c65de51d7",
              "versionType": "git"
            },
            {
              "lessThan": "5f29dd540fe5ea3c826fc8ec759ba488b31f9707",
              "status": "affected",
              "version": "e4f2379db6c6823c5d4a4c2c912df00c65de51d7",
              "versionType": "git"
            },
            {
              "lessThan": "6fc7449773748c7b904235a09a67054d78ab1172",
              "status": "affected",
              "version": "e4f2379db6c6823c5d4a4c2c912df00c65de51d7",
              "versionType": "git"
            },
            {
              "lessThan": "81431da777924dddaefa5c9b0ca9da4a93f9df96",
              "status": "affected",
              "version": "e4f2379db6c6823c5d4a4c2c912df00c65de51d7",
              "versionType": "git"
            },
            {
              "lessThan": "d0f2386f529807826e7404d40a245ee428f89f62",
              "status": "affected",
              "version": "e4f2379db6c6823c5d4a4c2c912df00c65de51d7",
              "versionType": "git"
            },
            {
              "lessThan": "8efd5dcd31e22a9308b16b107a052fcd568c0a99",
              "status": "affected",
              "version": "e4f2379db6c6823c5d4a4c2c912df00c65de51d7",
              "versionType": "git"
            },
            {
              "lessThan": "8f9adb3605e36f75639de529bb3d66e94194a388",
              "status": "affected",
              "version": "e4f2379db6c6823c5d4a4c2c912df00c65de51d7",
              "versionType": "git"
            },
            {
              "lessThan": "2503d08f8a2de618e5c3a8183b250ff4a2e2d52c",
              "status": "affected",
              "version": "e4f2379db6c6823c5d4a4c2c912df00c65de51d7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/arc/emac_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.11"
            },
            {
              "lessThan": "3.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.78",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.19",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.9",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: arc: emac: quiesce interrupts before requesting IRQ\n\nNormal RX/TX interrupts are enabled later, in arc_emac_open(), so probe\nshould not see interrupt delivery in the usual case. However, hardware may\nstill present stale or latched interrupt status left by firmware or the\nbootloader.\n\nIf probe later unwinds after devm_request_irq() has installed the handler,\nsuch a stale interrupt can still reach arc_emac_intr() during teardown and\nrace with release of the associated net_device.\n\nAvoid that window by putting the device into a known quiescent state before\nrequesting the IRQ: disable all EMAC interrupt sources and clear any\npending EMAC interrupt status bits. This keeps the change hardware-focused\nand minimal, while preventing spurious IRQ delivery from leftover state."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is in ARC/Rockchip EMAC platform probe/teardown (arc_emac_probe \u2192 free_netdev while the devm IRQ remains), not in packet processing; a remote or adjacent peer cannot induce this path via Ethernet frames.\nAC:H - Exploitation needs leftover firmware/bootloader-latched EMAC IRQ state plus a post-request_irq probe failure overlapping interrupt delivery; the attacker does not control that hardware/firmware precondition or IRQ timing.\nPR:L - An unprivileged local user can drive post-request_irq failures such as dmam_alloc_coherent -ENOMEM via memory pressure during deferred probe after userspace is up; platform bind/unbind is root-only but is not required for this path.\nUI:N - No victim action is required; once leftover IRQ state exists, the attacker can induce probe failure and race teardown without another user opening or configuring the interface.\nS:U - Impact is use-after-free/corruption inside the host kernel EMAC interrupt path and does not cross a VM, IOMMU, or other separate security authority.\nC:H - arc_emac_intr can run on a freed or half-initialized net_device (netdev_priv, NAPI, stats), a use-after-free that can expose attacker-influenced kernel heap contents.\nI:H - The same UAF lets the IRQ handler write through reclaimed net_device/NAPI state (e.g. napi_schedule), enabling heap corruption and potential control-flow hijacking.\nA:H - Dereferencing freed or uninitialized NAPI/netdev state in IRQ context can oops or panic the kernel, causing full denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-08T15:13:24.903Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/abd338da658d7faa8e26cfefc8f83f0066707564"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f29dd540fe5ea3c826fc8ec759ba488b31f9707"
        },
        {
          "url": "https://git.kernel.org/stable/c/6fc7449773748c7b904235a09a67054d78ab1172"
        },
        {
          "url": "https://git.kernel.org/stable/c/81431da777924dddaefa5c9b0ca9da4a93f9df96"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0f2386f529807826e7404d40a245ee428f89f62"
        },
        {
          "url": "https://git.kernel.org/stable/c/8efd5dcd31e22a9308b16b107a052fcd568c0a99"
        },
        {
          "url": "https://git.kernel.org/stable/c/8f9adb3605e36f75639de529bb3d66e94194a388"
        },
        {
          "url": "https://git.kernel.org/stable/c/2503d08f8a2de618e5c3a8183b250ff4a2e2d52c"
        }
      ],
      "title": "net: ethernet: arc: emac: quiesce interrupts before requesting IRQ",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64587",
    "datePublished": "2026-08-06T07:06:27.765Z",
    "dateReserved": "2026-07-19T15:36:31.798Z",
    "dateUpdated": "2026-08-08T15:13:24.903Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.