CVE-2026-43173
NULL Pointer Dereference in Linux Kernel XScale Ethernet Driver
Publication date: 2026-05-06
Last updated on: 2026-05-06
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux_kernel | linux_kernel | * |
| linux | linux_kernel | to 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to crash due to a NULL pointer dereference when certain network tools like tcpdump attempt to access timestamping information on unsupported hardware. This results in a segmentation fault, leading to system instability or denial of service.
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's ethernet driver for xscale processors. The function ixp4xx_get_ts_info() calls ixp46x_ptp_find() unconditionally, even though the feature it checks for only exists on ixp46x hardware. This leads to a NULL pointer dereference and a kernel crash (segmentation fault) when tcpdump or similar tools try to access timestamping information.
The issue occurs because the code does not properly check if the hardware supports Precision Time Protocol (PTP) before calling the function that sets up PTP. The fix involves adding a check for ixp46x hardware before attempting to set up PTP, preventing the kernel from crashing.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by observing a kernel NULL pointer dereference splat related to the ixp46x_ptp_find() function when using tcpdump on an affected system.
A suggested command to detect this issue is running tcpdump with verbose and hex output on the affected network interface, for example:
- tcpdump -vv -X -i eth0
If the vulnerability is present, the output may include a kernel NULL pointer dereference error and a segmentation fault call trace involving ixp46x_ptp_find and ixp4xx_get_ts_info functions.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that the kernel code checks for the presence of ixp46x before calling ixp46x_ptp_find(), thereby avoiding the NULL pointer dereference.
Specifically, the fix involves modifying ixp4xx_get_ts_info() to verify ixp46x support before attempting to set up PTP (Precision Time Protocol).
If you are using a Linux kernel version affected by this issue, update to a patched version where this check is implemented.