{"id":"UBUNTU-CVE-2026-90591","details":"The NXP ENET-QOS Ethernet driver's receive work handler eth_nxp_enet_qos_rx() in drivers/ethernet/eth_nxp_enet_qos hands each processed descriptor back to the DMA by writing desc-\u003eread.control = rx_desc_refresh_flags, which sets OWN_FLAG and BUF1_ADDR_VALID_FLAG. RDES0 of a receive descriptor is the DMA buffer address in read format, but the hardware write-back aliases that word with the VLAN tag fields (or, for a context descriptor, the timestamp low word), so it is destroyed on every completion. The success path rewrites desc-\u003eread.buf1_addr before re-arming; the four drop paths — errored or non-first descriptor, net_pkt_rx_alloc() failure, invalid descriptor length, and net_pkt_get_frag() failure — did not, re-arming the ring slot with the write-back residue as its DMA target address. The drop paths are driven entirely by received traffic and need no privilege or special configuration. With the defaults for this driver (CONFIG_NET_BUF_DATA_SIZE of 128 and 16 receive descriptors) a single full-size frame consumes twelve ring slots and twelve K_NO_WAIT fragment allocations, so a short burst of frames sent to the device exhausts the receive pools and reaches the allocation-failure paths; a frame with a receive error, or any frame whose first descriptor was already dropped, reaches the non-first-descriptor path. Once a slot has been poisoned, the DMA writes the next frame received in that slot to an address derived from the frame's VLAN tag fields rather than to a receive buffer. On the supported MCX SoCs that address falls in flash or reserved space, so the transfer raises a fatal bus error that the driver only logs — there is no reset or recovery path — and reception stops permanently until the device is rebooted; where the write is silently discarded instead, the untouched buffer is later handed to the network stack with a length, delivering stale buffer contents as if they were a received frame. A single triggering event is enough to make the condition persistent, so an attacker able to send traffic to the device can permanently disable its network interface.","modified":"2026-11-11T09:41:40.847879682Z","published":"2026-11-10T00:00:00Z","upstream":["CVE-2026-90591"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-90591"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-90591"},{"type":"REPORT","url":"github.com/zephyrproject-rtos/zephyr"}],"affected":[{"package":{"name":"zephyr","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/zephyr?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.2-1","3.1.2-1build1"],"ecosystem_specific":{"binaries":[{"binary_name":"libzephyr4","binary_version":"3.1.2-1build1"},{"binary_name":"libzephyr4-krb5","binary_version":"3.1.2-1build1"},{"binary_name":"zephyr-clients","binary_version":"3.1.2-1build1"},{"binary_name":"zephyr-server","binary_version":"3.1.2-1build1"},{"binary_version":"3.1.2-1build1","binary_name":"zephyr-server-krb5"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-90591.json"}},{"package":{"name":"zephyr","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/zephyr?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.2-1build1","3.1.2-1build2"],"ecosystem_specific":{"binaries":[{"binary_name":"libzephyr4","binary_version":"3.1.2-1build2"},{"binary_version":"3.1.2-1build2","binary_name":"libzephyr4-krb5"},{"binary_name":"zephyr-clients","binary_version":"3.1.2-1build2"},{"binary_name":"zephyr-server","binary_version":"3.1.2-1build2"},{"binary_name":"zephyr-server-krb5","binary_version":"3.1.2-1build2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-90591.json"}},{"package":{"name":"zephyr","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/zephyr?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.2-1build3"],"ecosystem_specific":{"binaries":[{"binary_name":"libzephyr4","binary_version":"3.1.2-1build3"},{"binary_name":"libzephyr4-krb5","binary_version":"3.1.2-1build3"},{"binary_name":"zephyr-clients","binary_version":"3.1.2-1build3"},{"binary_version":"3.1.2-1build3","binary_name":"zephyr-server"},{"binary_name":"zephyr-server-krb5","binary_version":"3.1.2-1build3"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-90591.json"}},{"package":{"name":"zephyr","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/zephyr?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.2-1build3"],"ecosystem_specific":{"binaries":[{"binary_name":"libzephyr4","binary_version":"3.1.2-1build3"},{"binary_version":"3.1.2-1build3","binary_name":"libzephyr4-krb5"},{"binary_name":"zephyr-clients","binary_version":"3.1.2-1build3"},{"binary_name":"zephyr-server","binary_version":"3.1.2-1build3"},{"binary_version":"3.1.2-1build3","binary_name":"zephyr-server-krb5"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-90591.json"}},{"package":{"name":"zephyr","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/zephyr?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.2-1.1","3.1.2-1.1build1"],"ecosystem_specific":{"binaries":[{"binary_name":"libzephyr4","binary_version":"3.1.2-1.1build1"},{"binary_version":"3.1.2-1.1build1","binary_name":"libzephyr4-krb5"},{"binary_name":"zephyr-clients","binary_version":"3.1.2-1.1build1"},{"binary_name":"zephyr-server","binary_version":"3.1.2-1.1build1"},{"binary_name":"zephyr-server-krb5","binary_version":"3.1.2-1.1build1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-90591.json"}},{"package":{"name":"zephyr","ecosystem":"Ubuntu:26.10","purl":"pkg:deb/ubuntu/zephyr?arch=source&distro=stonking"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.2-4"],"ecosystem_specific":{"binaries":[{"binary_name":"libzephyr4","binary_version":"3.1.2-4"},{"binary_version":"3.1.2-4","binary_name":"libzephyr4-krb5"},{"binary_name":"zephyr-clients","binary_version":"3.1.2-4"},{"binary_name":"zephyr-server","binary_version":"3.1.2-4"},{"binary_version":"3.1.2-4","binary_name":"zephyr-server-krb5"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-90591.json"}},{"package":{"name":"zephyr","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/zephyr?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.2-1.1build1","3.1.2-4"],"ecosystem_specific":{"binaries":[{"binary_version":"3.1.2-4","binary_name":"libzephyr4"},{"binary_name":"libzephyr4-krb5","binary_version":"3.1.2-4"},{"binary_version":"3.1.2-4","binary_name":"zephyr-clients"},{"binary_version":"3.1.2-4","binary_name":"zephyr-server"},{"binary_version":"3.1.2-4","binary_name":"zephyr-server-krb5"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-90591.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"medium"}]}