CVE-2026-53300: net: enetc: fix NTMP DMA use-after-free issue
In the Linux kernel, the following vulnerability has been resolved:
net: enetc: fix NTMP DMA use-after-free issue
The AI-generated review reported a potential DMA use-after-free issue [1]. If netcxmitntmpcmd() times out and returns an error, the pending command is not explicitly aborted, while ntmpfreedatamem() unconditionally frees the DMA buffer. If the buffer has already been reallocated elsewhere, this may lead to silent memory corruption. Because the hardware eventually processes the pending command and perform a DMA write of the response to the physical address of the freed buffer.
To resolve this issue, this patch does the following modifications:
1. Convert cbdr->ringlock from a spinlock to a mutex
The lock was originally a spinlock in case NTMP operations might be invoked from atomic context. After downstream support for all NTMP tables, no such usage has materialized. A mutex lock is now required because the driver now needs to reclaim used BDs and release associated DMA memory within the lock's context, while dmafreecoherent() might sleep.
2. Introduce software command BD (struct netcswcbd)
The hardware write-back overwrites the addr and len fields of the BD, so the driver cannot rely on the hardware BD to free the associated DMA memory. The driver now maintains a software shadow BD storing the DMA buffer pointer, DMA address, and size. And netcxmitntmpcmd() only reclaims older BDs when the number of used BDs reaches NETCCBDRCLEANWORK (16). The software BD enables correct DMA memory release. With this, struct ntmpdmabuf and ntmpfreedatamem() are no longer needed and are removed.
3. Require callers to hold ringlock across netcxmitntmpcmd()
netcxmitntmpcmd() releases the ringlock before the caller finishes consuming the response. At this point, if a concurrent thread submits a new command, it may trigger ntmpcleancbdr() and free the DMA buffer while it is still in use. Move ringlock ownership to the caller to ensure the response buffer cannot be reclaimed prematurely. So the helpers ntmpselectandlockcbdr() and ntmpunlockcbdr() are added.
These changes eliminate the DMA use-after-free condition and ensure safe and consistent BD reclamation and DMA buffer lifecycle management.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel ENETC driver and its NTMP command path are exposed. The issue is local-only according to the CVSS vector and requires an attacker to have low-privileged local access.
What conditions trigger the memory corruption?
The condition occurs when netc_xmit_ntmp_cmd() times out, leaving a pending hardware command while ntmp_free_data_mem() frees its DMA buffer. When hardware later completes the command, it can DMA-write a response to the freed physical memory, potentially causing silent corruption.
Does exploitation require user interaction or network access?
No user interaction is required, and the reported CVSS vector specifies local access rather than network access. The attacker must already have low privileges on the affected system.
What is the security impact?
The reported severity is high, with a CVSS 3.1 score of 7.8. The vector indicates high impact to confidentiality, integrity, and availability.