CVE-2026-90059— Linux内核 STMMAC驱动 RX DMA 缓冲区越界写漏洞
一分钟漏洞结论
影响对象
Linux Linux
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
在 Linux 内核中，已修复以下漏洞： net: stmmac: 在接收（RX）DMA 偏移中恢复 NET_IP_ALIGN 自接收路径转换为零拷贝（zero-copy）后，页面池（page pool）中的页面直接作为 的头部（head）交给协议栈，而 DMA 引擎写入数据的偏移量决定了报文头部（packet headers）的对齐方式。 在转换之前，报文负载会被复制到通过 获取的 中，该函数会预留 的前导空间。转换过程中，前导空间被移到了 中，但遗漏了 ，导致在 为 2 的架构上，IP 头部会出现对齐错误： 6
影响版本矩阵 8
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| Linux | Linux | df542f669307918f054a17878ff6dd1ddbb2fe18< 2ea42936416b29cca42b2c7bc7d3d3768f77c199 |
affected |
df542f669307918f054a17878ff6dd1ddbb2fe18< c0d3f9560cc890bc2d96d9f487584688ae6e5185 |
affected | ||
df542f669307918f054a17878ff6dd1ddbb2fe18< 23680bf5f8c69c923546b84a8e6c401bef8b88fe |
affected | ||
6.14 |
affected | ||
< 6.14 |
unaffected | ||
6.18.52≤ 6.18.* |
unaffected | ||
7.2.6≤ 7.2.* |
unaffected | ||
7.3-rc1≤ * |
unaffected |
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-90059 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
net: stmmac: restore NET_IP_ALIGN in the RX DMA offset
来源: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
net: stmmac: restore NET_IP_ALIGN in the RX DMA offset
Since the RX path was converted to zero-copy, the page pool page is handed
to the stack directly as the skb head, and the offset the DMA engine writes
at is what determines the alignment of the packet headers.
Before the conversion the payload was copied into an skb obtained from
napi_alloc_skb(), which reserves NET_SKB_PAD + NET_IP_ALIGN. The
conversion moved the headroom into stmmac_rx_offset() but did not carry
over NET_IP_ALIGN, so on architectures where NET_IP_ALIGN is 2 the IP
header now lands misaligned:
64 (NET_SKB_PAD) + 14 (ethernet) + 20 (IP) = 98
Same for the XDP branch:
256 (XDP_PACKET_HEADROOM) + 14 (ethernet) + 20 (IP) = 290
On ARM32 this is fatal, because ldm and ldrd trap on unaligned addresses
even when CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS is set.
Any received echo request panics the machine, e.g:
Unhandled fault: alignment exception (0x001) at 0x81873062
Internal error: : 1 [#1] SMP ARM
Hardware name: Altera SOCFPGA Arria10
PC is at icmp_echo+0x38/0xa8
LR is at icmp_rcv+0x22c/0x370
Call trace:
icmp_echo from icmp_rcv+0x22c/0x370
icmp_rcv from ip_protocol_deliver_rcu+0x2c/0x224
ip_protocol_deliver_rcu from ip_local_deliver+0xc8/0x1a0
ip_local_deliver from ip_sublist_rcv_finish+0x3c/0x50
ip_sublist_rcv_finish from ip_list_rcv_finish+0x110/0x118
ip_list_rcv_finish from ip_list_rcv+0xc8/0xdc
ip_list_rcv from __netif_receive_skb_list_core+0x170/0x1c0
...
napi_complete_done from stmmac_napi_poll_rx+0xcb0/0x1030
Code: e24dd068 e59020a0 e28dc010 e0822001 (e8920003)
Kernel panic - not syncing: Fatal exception in interrupt
The faulting instruction is the ldm of *icmp_hdr(skb) in icmp_echo().
Fix by adding NET_IP_ALIGN back to the RX offset, which restores the
alignment the stack used to get.
Note that commit a955318fe67e ("stmmac: align RX buffers") made a similar
change in 2021 and was reverted by commit 12d125b4574b ("stmmac: Revert
"stmmac: align RX buffers"") because it caused packet corruption. That
patch raised the offset from 0 without adjusting the buffer size
accounting, so the DMA engine could arguably write past the end of the RX
buffers, though this was never root caused.
Commit df542f669307 ("net: stmmac: Switch to zero-copy in non-XDP RX
path") since derives the page pool allocation from stmmac_rx_offset(), so
the extra bytes are accounted for.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5
受影响产品
二、漏洞 CVE-2026-90059 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-90059 的情报信息
请登录查看更多情报信息。
CVE-2026-90059 补丁与修复 (3)
同批安全公告 · Linux · 2026-09-17 · 共 600 条
| CVE-2026-90173 | 9.8 CRITICAL | SMB SmbDirect 释放完成队列漏洞 |
| CVE-2026-90235 | 9.8 CRITICAL | 内核sunrpc xprtsock并发读取修复 |
| CVE-2026-90151 | 9.8 CRITICAL | NFSv4客户端分配失败回调处理漏洞 |
| CVE-2026-92489 | 9.8 CRITICAL | Linux内核 xfrm 双重释放漏洞 |
| CVE-2026-90104 | 9.8 CRITICAL | NFSv4.1 解码前未清空调用列表 |
| CVE-2026-90110 | 9.4 CRITICAL | inetpeer 随机化RB树节点比较 |
| CVE-2026-90413 | 9.1 CRITICAL | IB/isert 登录PDU数据长度校验漏洞 |
| CVE-2026-90414 | 9.1 CRITICAL | IB/isert拒绝声明超出实际接收数据的PDU |
| CVE-2026-90230 | 9.1 CRITICAL | Linux内核Nvme-target堆越界读取漏洞 |
| CVE-2026-90425 | 8.8 HIGH | Linux内核 5.x 内核漏洞 |
| CVE-2026-90286 | 8.8 HIGH | AMDGPU GFX6 计算队列PFP使用漏洞 |
| CVE-2026-93042 | 8.8 HIGH | Linux内核dmaengine模块资源耗尽漏洞 |
| CVE-2026-90329 | 8.8 HIGH | Linux 内核 HID 驱动探测清理同步漏洞 |
| CVE-2026-90256 | 8.8 HIGH | Linux Bluetooth L2CAP 远程代码执行漏洞 |
| CVE-2026-90255 | 8.8 HIGH | Linux内核 Bluetooth 漏洞 |
| CVE-2026-90162 | 8.8 HIGH | Linux ksmbd 锁授予UAF/双重释放竞态漏洞 |
| CVE-2026-90381 | 8.8 HIGH | Linux内核mt76驱动无线信道切换漏洞 |
| CVE-2026-90367 | 8.8 HIGH | Linux内核MT7996驱动死锁漏洞 |
| CVE-2026-90371 | 8.8 HIGH | mt76 无线驱动 RXDMAD_C 竞态修复 |
| CVE-2026-90379 | 8.8 HIGH | Linux 内核 mt76 驱动系统崩溃漏洞 |
显示前 20 条，共 600 条。 查看全部 → →
IV. Related Vulnerabilities
V. Comments for CVE-2026-90059
暂无评论