Cloudanix VulnDB

CVE-2026-99188

None

CVSS

—

EPSS

0.2%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A driver bug in certain network chips can make a computer freeze or restart when waking from sleep, interrupting normal operation until the software is updated.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Denial of service
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Unmasked RGMII status interrupt remains pending after link changes and resume because GMAC_RGSMIIIS is never read; subsequent MAC interrupts trigger repeated dwmac_dma_interrupt handling that starves the CPU and produces soft lockups or watchdog resets.

Why it matters to the business

Systems using affected stmmac Ethernet controllers experience kernel hangs or forced reboots during resume from suspend, causing unplanned downtime on servers, embedded devices, and network appliances.

How an attack unfolds

An attacker with local access or the ability to trigger suspend/resume cycles (for example via power management scripts or Wake-on-LAN) forces the MAC into the faulty resume path; the uncleared interrupt then floods the handler, starving the CPU and crashing the system.

How to fix it

Apply the upstream fix that reads GMAC_RGSMIIIS inside dwmac1000_irq_status when the status bit is unmasked; update to a kernel containing commit clearing the pending RGMII interrupt on resume.

How to confirm the fix worked

Confirm the patch is present by inspecting dwmac1000_irq_status for the GMAC_RGSMIIIS read; reproduce resume cycles on affected hardware and verify absence of 'unexpected status 04000000' messages and soft lockups.

Typical attack path

  1. Gain ability to initiate suspend or s2idle on target system
  2. Trigger resume while MAC interrupt and resume thread share a CPU
  3. Observe repeated dwmac_dma_interrupt messages and soft lockup watchdog
  4. System hangs or reboots

How to detect it

Search kernel logs for 'dwmac_dma_interrupt: unexpected status 04000000', 'soft lockup', and register dumps showing non-zero rgsmiiis values after resume; correlate with stmmac resume paths on dwmac1000 hardware.

  • dwmac_dma_interrupt: unexpected status 04000000
  • core int_status 00000001 int_mask 00000000 pmt 00000000 rgsmiiis 0000000d

What your security team should do

  • Prioritize patching kernels on all devices using dwmac1000 or dwmac-rk/meson8b variants
  • Disable Wake-on-LAN or s2idle suspend where operationally feasible until patched
  • Monitor kernel logs for 'unexpected status 04000000' and soft lockup reports on stmmac hardware

The record

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: dwmac1000: clear the RGMII status interrupt Since commit 2e2c878a3141 ("net: stmmac: remove SGMII/RGMII/SMII interrupt handling") nothing on the RGMII path reads GMAC_RGSMIIIS, so RGSMIIIS stays pending behind GMAC_INT_MASK from the first link change on. stmmac_resume() resets the MAC in stmmac_hw_setup(); the reset sets GMAC_INT_MASK to 0 until dwmac1000_core_init() writes the mask again, and the pending status storms the line: dwmac_dma_interrupt: unexpected status 04000000 A register dump at the first message on ODROID-HC4 showed it: core int_status 00000001 int_mask 00000000 pmt 00000000 rgsmiiis 0000000d When the resume thread runs on the CPU that takes the MAC interrupt, the storm starves it: a soft lockup, then a watchdog reset or a hang. Read GMAC_RGSMIIIS in dwmac1000_irq_status() when the status is not masked, as the driver did before 2e2c878a3141; the read clears it. Wake-on-LAN resume from s2idle with the resume thread and the MAC interrupt on one CPU: Helios64 (dwmac-rk), 7.3-rc6, soft-locked in 3 of 3 resumes without a fix and in 0 of 10 with this patch; it ran with an out-of-tree dwmac-rk change that keeps the GMAC powered across suspend. ODROID-HC4 (dwmac-meson8b): 0 of 10 with this patch, 2 of 2 without a fix on a 7.3-rc5 build. irq_rgmii_n went up by one per resume.

Affected packages

Ecosystem Package Introduced Fixed