CVE-2026-74737 in Linux
Summary
by MITRE • 08/26/2026
In the Linux kernel, the following vulnerability has been resolved:
net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
On the packet reception path, the ID of the MAC Port on which the packet was received, is embedded in the RX DMA Descriptor's metadata. The ID is extracted using the helper function cppi5_desc_get_tags_ids() which fills in the 16-bit Source Tag into the 'port_id' variable. However, it is only the lower 8-bits of the 16-bit Source Tag that represent the MAC Port ID, while the upper 8-bits are Hardware-Reserved and carry an arbitrary value. With the existing logic, sporadic kernel crash is observed due to the subsequent driver code accessing out-of-bound memory because of an invalid port_id.
Hence, fix the port_id extraction logic to use only the lower 8-bits of the Source Tag as the MAC Port ID.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified in the Linux kernel's Ethernet subsystem for Texas Instruments AM65 CPSW-NUSS drivers stems from an incorrect handling of hardware descriptor metadata during packet reception. The network driver relies on a helper function, cppi5_desc_get_tags_ids(), to extract identification information from RX DMA descriptors. This function retrieves a 16-bit Source Tag field which is intended to identify the specific MAC port through which a network frame was received. However, the implementation fails to distinguish between meaningful data and reserved hardware bits within this descriptor structure. Specifically, only the lower eight bits of the sixteen-bit Source Tag contain valid information regarding the MAC Port ID, while the upper eight bits are designated as Hardware-Reserved fields that may hold arbitrary or undefined values depending on the specific hardware state or revision.
The core technical flaw lies in the driver's failure to mask out these reserved upper bits before utilizing the extracted value. By treating the entire sixteen-bit integer as a valid port identifier, the code inadvertently incorporates random data from the reserved section into the port_id variable. This results in an invalid and unpredictable port identifier being passed to subsequent stages of the network stack and driver logic. When this corrupted identifier is used for array indexing or memory access operations that depend on it representing a valid hardware port number, the system attempts to access memory locations outside the allocated bounds associated with known ports.
This out-of-bounds memory access leads to sporadic kernel crashes, manifesting as null pointer dereferences, page faults, or general protection faults depending on what invalid address is computed from the erroneous port_id. The impact of this vulnerability includes service disruption due to system instability and potential denial of service conditions where network connectivity becomes unreliable under specific traffic patterns that trigger the faulty descriptor processing path. From a security perspective, while primarily causing stability issues rather than direct privilege escalation in most scenarios, such memory corruption vulnerabilities can potentially be exploited for information disclosure or code execution if an attacker can influence packet reception rates to consistently trigger the bug and analyze crash dumps or system behavior.
The vulnerability aligns with CWE-125, Out-of-bounds Read, as the driver reads beyond valid data boundaries within its internal structures due to incorrect index calculation. It also relates to CWE-697, Incorrect Comparison, in a broader sense of failing to correctly validate input values against expected constraints before use. In terms of MITRE ATT&CK mapping, this type of flaw falls under T1053 Scheduled Task/Job or more accurately within the context of local exploitation techniques like T1203 Exploitation for Defense Evasion if leveraged in a broader attack chain, though primarily it represents a reliability issue categorized under software faults rather than active adversary tactics.
To mitigate this vulnerability, developers must apply the patch that modifies the cppi5_desc_get_tags_ids() function or its usage to explicitly mask the upper eight bits of the Source Tag. This ensures that only the lower byte containing the valid MAC Port ID is used for subsequent operations. System administrators should update their kernels to versions where this fix is included, particularly those targeting TI AM65 series SoCs using the CPSW-NUSS driver. Regular kernel updates and patch management are essential to address such low-level hardware abstraction layer bugs that can compromise system stability.