The NXP ENET-QOS Ethernet driver's receive work handler ethnxpenetqosrx() in drivers/ethernet/ethnxpenetqos hands each processed descriptor…
CVE-2026-90591
The NXP ENET-QOS Ethernet driver's receive work handler ethnxpenetqosrx() in drivers/ethernet/ethnxpenetqos hands each processed descriptor back to the DMA by writing desc->read.control = rxdescrefreshflags, which sets OWNFLAG and BUF1ADDRVALIDFLAG. RDES0 of a receive descriptor is the DMA buffer address in read format, but the hardware write-back aliases that word with the VLAN tag fields (or, for a context descriptor, the timestamp low word), so it is destroyed on every completion. The success path rewrites desc->read.buf1addr before re-arming; the four drop paths — errored or non-first descriptor, netpktrxalloc() failure, invalid descriptor length, and netpktgetfrag() failure — did not, re-arming the ring slot with the write-back residue as its DMA target address. The drop paths are driven entirely by received traffic and need no privilege or special configuration. With the defaults for this driver (CONFIGNETBUFDATASIZE of 128 and 16 receive descriptors) a single full-size frame consumes twelve ring slots and twelve KNOWAIT fragment allocations, so a short burst of frames sent to the device exhausts the receive pools and reaches the allocation-failure paths; a frame with a…
Assessment
- CVSS
- 7.5 (v3.1)
- Severity
- High
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 9 November 2026
- Last updated
- 9 November 2026
- Affected
- zephyrproject · Zephyr
- Assigner
- zephyr
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
At the source
References
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-90591