A recently disclosed vulnerability in the Linux kernel’s stmmac Ethernet driver can trigger a kernel crash when processing network packets with split header mode enabled on GMAC4 hardware. The bug, tracked as CVE-2026-45940, was published by the National Vulnerability Database (NVD) on May 27, 2026, and has been resolved in stable kernel branches. Although initial NVD analysis labeled it “awaiting enrichment,” the database has since assigned a CVSS 3.1 base score of 5.5 (Medium), reflecting its high availability impact but a local attack vector.

This isn’t a theoretical flaw. The crash path runs straight through the driver’s high-speed packet receive polling, meaning routine network traffic—not just a targeted attack—could take down an affected device. For administrators of embedded systems, industrial controllers, network appliances, or any Arm-based device using a Synopsys DesignWare Ethernet MAC, this is not a drill.

How a Wrong Assumption Causes a Kernel Oops

The stmmac driver supports a performance feature called “split header.” It separates packet headers from payloads into different buffers, allowing the networking stack to inspect headers without copying entire packets. This saves CPU cycles, especially valuable on resource-constrained embedded systems. But in GMAC4 hardware, the driver’s receive path made a dangerous assumption: it treated the second buffer (buf2) of every non-last descriptor as fully populated with payload data.

According to the CVE description, in rare cases the hardware doesn’t fill buf2 on the first descriptor, leaving the buffer length calculation wrong for the second descriptor. That leads to an invalid memory access and a kernel oops. The NVD record includes a call trace showing the crash happens during DMA cache synchronization after entering stmmac_napi_poll_rx:

dcache_inval_poc+0x28/0x58
dma_direct_sync_single_for_cpu+0x38/0x6c
__dma_sync_single_for_cpu+0x34/0x6c
stmmac_napi_poll_rx+0x8f0/0xb60
__napi_poll.constprop.0+0x30/0x144
net_rx_action+0x160/0x274
handle_softirqs+0x1b8/0x1fc

The fix, merged upstream, is straightforward: use the PL (Packet Length) bit-field from the RDES3 register for every descriptor, not just the last one. This ensures the driver always reads the actual payload length reported by hardware, rather than relying on a heuristic that could be wrong.

What’s at Stake: Not Just Servers

The stmmac driver may sound obscure, but it underpins the Ethernet interface on a wide range of devices. Synopsys DesignWare IP appears in system-on-chips (SoCs) from STMicroelectronics, NXP, Rockchip, and Intel (certain platforms). It’s commonly found on ARM development boards, home routers, NAS boxes, industrial gateways, and even some automotive platforms. If your Linux-based device uses a GMAC4-class controller and has split header enabled, it’s potentially vulnerable.

The practical impact is denial of service. A kernel oops in the network receive path can freeze the network interface, crash the system, or force an unexpected reboot. For an internet-facing appliance or a production industrial controller, that means downtime—and possibly a truck roll if the device requires physical access to recover. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) rates the attack complexity as low and privileges required as low, but the attack vector as local because the attacker needs to send network packets to the target interface. In reality, any device with a network connection could be a target, making the risk higher than the score suggests for exposed systems.

Affected Kernel Versions and the Patch

The vulnerability was introduced by a specific commit in the kernel’s stmmac driver and is present in mainline Linux versions from 5.4 up to (but not including) 6.18.14, and also in the 6.19 release up to (but not including) 6.19.4. The fix is included in:

  • Linux 6.18.14 and later 6.18.y updates
  • Linux 6.19.4 and later 6.19.y updates
  • Linux 7.0 and later

The stable git commits addressing the bug are:
- b1f23df09e7dbf4c86b6908dff7efb8cb2b7d609
- 36f81cb7d82e9614a7058da6abdf2e3a03993df1
- babab1b42ed68877ef669a08384becf281ad2582

If you run a distribution kernel (Ubuntu, Debian, Red Hat, etc.), check whether these patches have been backported. Many enterprise distributions maintain their own LTS kernels and often incorporate fixes before the next major version bump. For self-compiled kernels, ensure you’ve pulled in the appropriate stable branch.

How We Got Here: Performance vs. Safety

Split header processing isn’t new. It was added to reduce CPU overhead in network-heavy workloads, especially on embedded chips where every cycle counts. But the feature adds complexity to the driver’s descriptor parsing. Instead of a simple linear buffer, the driver must handle multiple descriptors with different fill patterns—something that edge cases in hardware behavior can easily trip.

This isn’t the first time the stmmac driver has seen issues with split header. Previous kernel work has tweaked the feature around VLANs, fragmented IPv4 packets, and XDP (eXpress Data Path) support. In each case, the pursuit of performance expanded the attack surface. The CVE process itself has evolved: kernel CVE assignments now flow directly from upstream maintainers, often resulting in early, terse advisories that lack CVSS scoring. NVD’s enrichment lag can leave administrators in the dark, but in this case, the initial “awaiting analysis” flag was resolved with a medium score about a month later.

The key lesson is that network driver optimizations are never free. Every clever feature—offloading, segmentation, receive‑side scaling, split buffers—introduces new assumptions. When one of those assumptions fails, it fails in the kernel’s most privileged and performance‑critical paths.

Action Plan: How to Protect Your Devices

  1. Identify Exposure
    Run ethtool -i eth0 (replacing eth0 with your interface name) to see if the driver is stmmac. You can also check with lspci -k (for PCI‑attached devices) or lsmod | grep stmmac. If you find it, note the hardware revision. GMAC4 is newer than GMAC3; checking the exact chipset model may require consulting device documentation or boot logs.

  2. Verify Split Header Status
    The feature is typically controlled by ethtool flags. Use ethtool -k eth0 | grep split-header to see if it’s enabled. Some devices may enable it by default in device‑tree or firmware settings, so even if the flag shows “off,” the driver could still use it under certain conditions. The safest path is to assume vulnerability unless you’re running a patched kernel.

  3. Apply the Fix
    - For distribution users: update to the latest kernel package provided by your vendor (e.g., apt upgrade, dnf update). Watch for advisories specific to this CVE.
    - For embedded or appliance owners: check with the manufacturer. Many devices run custom kernels, and you’ll need a firmware update. Don’t rely on kernel version alone—ask whether the vendor has backported the fix.
    - For build‑it‑yourself systems: pull the latest stable branch (6.18.14+, 6.19.4+, or 7.0+) or apply the specific commits from the kernel.org Git tree.

  4. Consider Temporary Mitigations (With Caution)
    Disabling split header might avoid the crash path, but it’s not a guaranteed workaround. The command ethtool -K eth0 split-header off could work on some kernels, but this may reduce throughput and isn’t supported on all hardware. If you must stay unpatched, isolate the device as much as possible and prioritize a real fix.

  5. Audit Your Linux‑Powered Infrastructure
    Even in Windows‑centric environments, Linux runs in routers, firewalls, storage controllers, VPN concentrators, and IoT sensors. These often get less patch attention than desktops and servers. Build an inventory that includes kernel versions and driver details, not just OS labels.

Outlook: More Bugs Like This Will Come

Network driver CVEs have become a regular fixture. As hardware offloads and performance optimizations push deeper into the kernel, the odds of similar length‑miscalculation bugs increase. The next one might affect a different driver—igc, ixgbe, mlx5, or virtio—but the pattern will look familiar.

For organizations that treat Linux as infrastructure, not as a primary endpoint OS, the real challenge is governance. CVE‑2026‑45940 is a reminder that a device you never log into still has a kernel, still has a PCI tree, and still needs patches. The CVSS score might be medium, but for the network‑attached device that dies silently in a wiring closet, the real impact is high. Treat it accordingly.