CVE-2026-64587 (GCVE-0-2026-64587)

Vulnerability from cvelistv5 – Published: 2026-08-06 07:06 – Updated: 2026-08-08 15:13
VLAI
Title
net: ethernet: arc: emac: quiesce interrupts before requesting IRQ
Summary
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: arc: emac: quiesce interrupts before requesting IRQ Normal RX/TX interrupts are enabled later, in arc_emac_open(), so probe should not see interrupt delivery in the usual case. However, hardware may still present stale or latched interrupt status left by firmware or the bootloader. If probe later unwinds after devm_request_irq() has installed the handler, such a stale interrupt can still reach arc_emac_intr() during teardown and race with release of the associated net_device. Avoid that window by putting the device into a known quiescent state before requesting the IRQ: disable all EMAC interrupt sources and clear any pending EMAC interrupt status bits. This keeps the change hardware-focused and minimal, while preventing spurious IRQ delivery from leftover state.
Severity
7 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: e4f2379db6c6823c5d4a4c2c912df00c65de51d7 , < abd338da658d7faa8e26cfefc8f83f0066707564 (git)
Affected: e4f2379db6c6823c5d4a4c2c912df00c65de51d7 , < 5f29dd540fe5ea3c826fc8ec759ba488b31f9707 (git)
Affected: e4f2379db6c6823c5d4a4c2c912df00c65de51d7 , < 6fc7449773748c7b904235a09a67054d78ab1172 (git)
Affected: e4f2379db6c6823c5d4a4c2c912df00c65de51d7 , < 81431da777924dddaefa5c9b0ca9da4a93f9df96 (git)
Affected: e4f2379db6c6823c5d4a4c2c912df00c65de51d7 , < d0f2386f529807826e7404d40a245ee428f89f62 (git)
Affected: e4f2379db6c6823c5d4a4c2c912df00c65de51d7 , < 8efd5dcd31e22a9308b16b107a052fcd568c0a99 (git)
Affected: e4f2379db6c6823c5d4a4c2c912df00c65de51d7 , < 8f9adb3605e36f75639de529bb3d66e94194a388 (git)
Affected: e4f2379db6c6823c5d4a4c2c912df00c65de51d7 , < 2503d08f8a2de618e5c3a8183b250ff4a2e2d52c (git)
Create a notification for this product.
Linux Linux Affected: 3.11
Unaffected: 0 , < 3.11 (semver)
Unaffected: 5.10.253 , ≤ 5.10.* (semver)
Unaffected: 5.15.203 , ≤ 5.15.* (semver)
Unaffected: 6.1.167 , ≤ 6.1.* (semver)
Unaffected: 6.6.130 , ≤ 6.6.* (semver)
Unaffected: 6.12.78 , ≤ 6.12.* (semver)
Unaffected: 6.18.19 , ≤ 6.18.* (semver)
Unaffected: 6.19.9 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/arc/emac_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "abd338da658d7faa8e26cfefc8f83f0066707564",
              "status": "affected",
              "version": "e4f2379db6c6823c5d4a4c2c912df00c65de51d7",
              "versionType": "git"
            },
            {
              "lessThan": "5f29dd540fe5ea3c826fc8ec759ba488b31f9707",
              "status": "affected",
              "version": "e4f2379db6c6823c5d4a4c2c912df00c65de51d7",
              "versionType": "git"
            },
            {
              "lessThan": "6fc7449773748c7b904235a09a67054d78ab1172",
              "status": "affected",
              "version": "e4f2379db6c6823c5d4a4c2c912df00c65de51d7",
              "versionType": "git"
            },
            {
              "lessThan": "81431da777924dddaefa5c9b0ca9da4a93f9df96",
              "status": "affected",
              "version": "e4f2379db6c6823c5d4a4c2c912df00c65de51d7",
              "versionType": "git"
            },
            {
              "lessThan": "d0f2386f529807826e7404d40a245ee428f89f62",
              "status": "affected",
              "version": "e4f2379db6c6823c5d4a4c2c912df00c65de51d7",
              "versionType": "git"
            },
            {
              "lessThan": "8efd5dcd31e22a9308b16b107a052fcd568c0a99",
              "status": "affected",
              "version": "e4f2379db6c6823c5d4a4c2c912df00c65de51d7",
              "versionType": "git"
            },
            {
              "lessThan": "8f9adb3605e36f75639de529bb3d66e94194a388",
              "status": "affected",
              "version": "e4f2379db6c6823c5d4a4c2c912df00c65de51d7",
              "versionType": "git"
            },
            {
              "lessThan": "2503d08f8a2de618e5c3a8183b250ff4a2e2d52c",
              "status": "affected",
              "version": "e4f2379db6c6823c5d4a4c2c912df00c65de51d7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/arc/emac_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.11"
            },
            {
              "lessThan": "3.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.78",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.19",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.9",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: arc: emac: quiesce interrupts before requesting IRQ\n\nNormal RX/TX interrupts are enabled later, in arc_emac_open(), so probe\nshould not see interrupt delivery in the usual case. However, hardware may\nstill present stale or latched interrupt status left by firmware or the\nbootloader.\n\nIf probe later unwinds after devm_request_irq() has installed the handler,\nsuch a stale interrupt can still reach arc_emac_intr() during teardown and\nrace with release of the associated net_device.\n\nAvoid that window by putting the device into a known quiescent state before\nrequesting the IRQ: disable all EMAC interrupt sources and clear any\npending EMAC interrupt status bits. This keeps the change hardware-focused\nand minimal, while preventing spurious IRQ delivery from leftover state."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is in ARC/Rockchip EMAC platform probe/teardown (arc_emac_probe \u2192 free_netdev while the devm IRQ remains), not in packet processing; a remote or adjacent peer cannot induce this path via Ethernet frames.\nAC:H - Exploitation needs leftover firmware/bootloader-latched EMAC IRQ state plus a post-request_irq probe failure overlapping interrupt delivery; the attacker does not control that hardware/firmware precondition or IRQ timing.\nPR:L - An unprivileged local user can drive post-request_irq failures such as dmam_alloc_coherent -ENOMEM via memory pressure during deferred probe after userspace is up; platform bind/unbind is root-only but is not required for this path.\nUI:N - No victim action is required; once leftover IRQ state exists, the attacker can induce probe failure and race teardown without another user opening or configuring the interface.\nS:U - Impact is use-after-free/corruption inside the host kernel EMAC interrupt path and does not cross a VM, IOMMU, or other separate security authority.\nC:H - arc_emac_intr can run on a freed or half-initialized net_device (netdev_priv, NAPI, stats), a use-after-free that can expose attacker-influenced kernel heap contents.\nI:H - The same UAF lets the IRQ handler write through reclaimed net_device/NAPI state (e.g. napi_schedule), enabling heap corruption and potential control-flow hijacking.\nA:H - Dereferencing freed or uninitialized NAPI/netdev state in IRQ context can oops or panic the kernel, causing full denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-08T15:13:24.903Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/abd338da658d7faa8e26cfefc8f83f0066707564"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f29dd540fe5ea3c826fc8ec759ba488b31f9707"
        },
        {
          "url": "https://git.kernel.org/stable/c/6fc7449773748c7b904235a09a67054d78ab1172"
        },
        {
          "url": "https://git.kernel.org/stable/c/81431da777924dddaefa5c9b0ca9da4a93f9df96"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0f2386f529807826e7404d40a245ee428f89f62"
        },
        {
          "url": "https://git.kernel.org/stable/c/8efd5dcd31e22a9308b16b107a052fcd568c0a99"
        },
        {
          "url": "https://git.kernel.org/stable/c/8f9adb3605e36f75639de529bb3d66e94194a388"
        },
        {
          "url": "https://git.kernel.org/stable/c/2503d08f8a2de618e5c3a8183b250ff4a2e2d52c"
        }
      ],
      "title": "net: ethernet: arc: emac: quiesce interrupts before requesting IRQ",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64587",
    "datePublished": "2026-08-06T07:06:27.765Z",
    "dateReserved": "2026-07-19T15:36:31.798Z",
    "dateUpdated": "2026-08-08T15:13:24.903Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64587",
      "date": "2026-08-08",
      "epss": "0.00176",
      "percentile": "0.07331"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.