CVE-2026-72060

Received Received - Intake

Buffer Overflow in Linux Kernel TI ICSSG Ethernet Driver

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: icssg: guard PA stat lookups icssg_ndo_get_stats64() unconditionally calls emac_get_stat_by_name() with FW PA stat names regardless of whether the PA stats block is present on the hardware. emac_get_stat_by_name() already guards the PA stats lookup with `if (emac->prueth->pa_stats)`; when that pointer is NULL the lookup falls through to netdev_err() and returns -EINVAL. Because ndo_get_stats64 is polled regularly by the networking stack this produces thousands of log entries of the form: icssg-prueth icssg1-eth end0: Invalid stats FW_RX_ERROR A secondary consequence is that the int(-EINVAL) return value is implicitly widened to a near-ULLONG_MAX unsigned value when accumulated into the __u64 fields of rtnl_link_stats64, silently corrupting the rx_errors, rx_dropped and tx_dropped counters reported by `ip -s link`. Every other PA-aware code path in the driver is already guarded with the same `if (emac->prueth->pa_stats)` check. Apply the same guard here.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72060

EUVD

EUVD-2026-59018

Affected Vendors & Products

Vendor	Product	Version / Range
ti	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves the icssg_ndo_get_stats64() function in the TI ICSSG Ethernet driver. It unconditionally attempts to fetch PA statistics even when the hardware lacks a PA stats block, causing repeated error logs and corrupting network counters.

Detection Guidance

Check kernel logs for repeated errors like 'icssg-prueth ... Invalid stats FW_RX_ERROR' which indicate the issue. Use 'dmesg | grep -i icssg' or 'journalctl -k | grep -i icssg' to search for these messages.

Impact Analysis

The vulnerability causes excessive error logs and silently corrupts network counters like rx_errors, rx_dropped, and tx_dropped. This can mislead network monitoring and troubleshooting efforts.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It primarily causes incorrect network statistics reporting due to corrupted counters in the Linux kernel's networking stack. No evidence suggests it impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Apply the Linux kernel patch that adds the missing guard for PA stats lookups in icssg_ndo_get_stats64(). Update to a kernel version containing the fix or backport the patch manually.

Hi! I’m here to help you understand CVE-2026-72060. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70