CVE-2026-53300: Linux ENETC Driver DMA Use-After-Free (CVSS 7.8)

Technical summary

CVE-2026-53300 affects the ENETC driver's NTMP (Network Table Management Protocol) command path in the Linux kernel. The vulnerability occurs in netc_xmit_ntmp_cmd() when a command times out. The driver frees the DMA buffer immediately via ntmp_free_data_mem() without verifying that in-flight hardware operations have completed. The hardware may subsequently DMA-write the response to the physical address of the now-freed buffer, causing silent memory corruption. The root cause is a race condition between software buffer reclamation and pending hardware DMA operations. Mitigation requires: (1) converting cbdr->ring_lock from spinlock to mutex to allow sleeping operations, (2) introducing a software command buffer descriptor (struct netc_swcbd) to maintain DMA metadata independent of the hardware-writable BD, and (3) extending lock ownership to callers so responses remain protected during consumption.

Business impact

This vulnerability can lead to silent kernel memory corruption on systems using the ENETC driver with NTMP table operations. Affected workloads may experience data integrity issues, kernel panics, or unpredictable system behavior. Because corruption is silent and asynchronous, it may not be detected immediately, increasing the window for cascading failures. For cloud or virtualized environments where ENETC is used, this could impact system stability and trustworthiness. The LOCAL privilege requirement means only local users or processes can trigger the issue, limiting blast radius compared to remote exploits.

Affected systems

The Linux kernel is affected, specifically distributions and systems running the ENETC driver with NTMP support enabled. This includes systems using QorIQ or similar NXP processors that expose the ENETC interface. Verify your kernel version and ENETC driver configuration against vendor advisories. Most server distributions and embedded Linux systems running affected kernel versions should be assessed.

Exploitability

Exploitation requires LOCAL access and privilege (non-root user context). An attacker with local system access can trigger the race condition by submitting NTMP commands that timeout and then allocating memory to observe corruption. The vulnerability is not trivial to exploit reliably due to the race condition's timing sensitivity, but the impact (memory corruption) is significant. The CVSS score of 7.8 reflects high impact with local/low complexity prerequisites. No public exploit code has been identified at this time.

Remediation

Apply the Linux kernel patch that resolves CVE-2026-53300. The patch modifies the ENETC driver to properly manage DMA buffer lifecycle and fix the race condition. Verify the specific kernel version containing the fix against your distribution's security advisories and patch release notes. For systems unable to immediately patch, restrict local access and monitor for unexpected kernel errors or memory corruption signs.

Patch guidance

Contact your Linux distribution vendor or check kernel.org for the specific kernel version and ENETC driver version containing the fix. The patch is likely available in stable kernel series updates published after 2026-07-08. Apply via standard kernel update mechanisms (apt, yum, etc.) or compile from source if necessary. Testing in non-production environments is recommended before deployment. Verify that the patched kernel includes the complete fix: spinlock-to-mutex conversion, software command BD introduction, and lock ownership changes to callers.

Detection guidance

Monitor system logs for NTMP-related timeouts or warnings from the ENETC driver. Unexpected kernel panics, memory corruption warnings (slab poisoning, page allocation failures), or irregular system behavior may indicate exploitation. If possible, enable kernel debugging and audit memory allocator messages. In virtualized environments, watch for VM instability correlated with NTMP operations. Detection is challenging because corruption may be silent; focus on prevention through patching and access control rather than post-facto detection.

Why prioritize this

Despite local-only access requirements, the HIGH severity (CVSS 7.8) and silent memory corruption impact warrant prioritization. Memory corruption can cascade and undermine system integrity across multiple services. The vulnerability affects kernel core functionality, and the race condition nature means timing-dependent exploitation could be triggered accidentally through normal workload patterns. Patch promptly for systems using ENETC and immediately for production systems with internet-facing services relying on system stability.

Risk score, explained

CVSS 7.8 (HIGH) reflects: Attack Vector LOCAL (requires system access), Attack Complexity LOW (no special conditions needed once access is gained), Privileges Required LOW (non-root local user), User Interaction NONE, Scope UNCHANGED, and Confidentiality/Integrity/Availability all HIGH (full memory corruption impact). The score appropriately captures the serious nature of kernel memory corruption balanced against the local-only attack vector. Real-world risk varies based on whether the ENETC driver and NTMP support are active in your environment.

Frequently asked questions