CVE-2026-43173: net: ethernet: xscale: Check for PTP support properly
In the Linux kernel, the following vulnerability has been resolved:
net: ethernet: xscale: Check for PTP support properly
In ixp4xxgettsinfo() ixp46xptpfind() is called unconditionally despite this feature only existing on ixp46x, leading to the following splat from tcpdump:
root@OpenWrt:~# tcpdump -vv -X -i eth0 (...) Unable to handle kernel NULL pointer dereference at virtual address 00000238 when read (...) Call trace: ptpclockindex from ixp46xptpfind+0x1c/0x38 ixp46xptpfind from ixp4xxgettsinfo+0x4c/0x64 ixp4xxgettsinfo from ethtoolgettsinfo+0x90/0x108 ethtoolgettsinfo from devethtool+0xa00/0x2648 devethtool from devethtool+0x160/0x234 devethtool from devioctl+0x2cc/0x460 devioctl from sockioctl+0x1ec/0x524 sockioctl from sysioctl+0x51c/0xa94 sysioctl from retfastsyscall+0x0/0x44 (...) Segmentation fault
Check for ixp46x in ixp46xptpfind() before trying to set up PTP to avoid this.
To avoid altering the returned error code from ixp4xxhwtstampset() which before this patch was -EOPNOTSUPP, we return -EOPNOTSUPP from ixp4xxhwtstampset() if ixp46xptpfind() fails no matter the error code. The helper function ixp46xptpfind() helper returns -ENODEV.
Affected Software
Remediation
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel ixp4xx Ethernet driver are exposed when the affected timestamp-information path is invoked on hardware that does not support the ixp46x PTP feature. The issue is associated with an unconditional call to an ixp46x-specific PTP helper.
What is required to trigger the failure?
A local user with low privileges must invoke the network device timestamp-information path, such as through an ethtool operation. The reported example was running tcpdump against eth0, which led to a kernel NULL pointer dereference and segmentation fault.
What is the impact of successful exploitation?
The vulnerable path can cause a kernel NULL pointer dereference, resulting in a crash or denial of service. The CVSS vector indicates no confidentiality or integrity impact, but high availability impact.
What can be done if the patch cannot be applied immediately?
Avoid invoking hardware timestamping or timestamp-information queries on interfaces using the affected ixp4xx driver, particularly on non-ixp46x hardware. Restrict untrusted local users from running tools or operations that query Ethernet timestamp capabilities.
How can administrators identify a likely occurrence?
Kernel logs may show an "Unable to handle kernel NULL pointer dereference" message with a call trace including ixp46x_ptp_find, ixp4xx_get_ts_info, and __ethtool_get_ts_info. Affected attempts may also cause the invoking tool, such as tcpdump, to report a segmentation fault.