CVE-2026-74737
Received Received - Intake

Port ID Extraction Flaw in AM65 CPSW NUSS Driver

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG On the packet reception path, the ID of the MAC Port on which the packet was received, is embedded in the RX DMA Descriptor's metadata. The ID is extracted using the helper function cppi5_desc_get_tags_ids() which fills in the 16-bit Source Tag into the 'port_id' variable. However, it is only the lower 8-bits of the 16-bit Source Tag that represent the MAC Port ID, while the upper 8-bits are Hardware-Reserved and carry an arbitrary value. With the existing logic, sporadic kernel crash is observed due to the subsequent driver code accessing out-of-bound memory because of an invalid port_id. Hence, fix the port_id extraction logic to use only the lower 8-bits of the Source Tag as the MAC Port ID.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-74737
EUVD
EUVD-2026-66567

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves incorrect extraction of the MAC port ID from network packet metadata. The driver code reads a 16-bit source tag but only the lower 8 bits represent the valid port ID. Using the full 16-bit value can lead to invalid port IDs, causing out-of-bounds memory access and sporadic kernel crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's TI AM65 CPSW NUSS driver and may not have direct detection commands. Monitor kernel logs for crashes or errors related to the am65-cpsw-nuss driver, especially during network packet reception. Check for out-of-bound memory access errors or invalid port_id values in system logs.

Impact Analysis

This vulnerability can cause system instability by triggering kernel crashes when network packets are processed. If you use affected Linux kernel versions with TI AM65 CPSW NUSS Ethernet devices, your system may become unresponsive or reboot unexpectedly during network operations.

Mitigation Strategies

Apply the kernel patch that fixes the port_id extraction logic to use only the lower 8-bits of the Source Tag. Update your Linux kernel to the patched version. If immediate patching is not possible, consider disabling the affected network interface or restricting network traffic until the patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74737. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart