CVE-2026-93830

A flaw was found in the Linux kernel's stmmac network driver. An attacker can cause a Denial of Service (DoS) by sending high volumes of network traffic to an affected system. Under heavy packet load, the network controller exhausts its receive buffers and continuously fires hardware interrupts before software can refill them. This interrupt storm monopolizes processor resources, leading to severe performance degradation or system unresponsiveness.

A moderate-impact denial-of-service flaw was found in the Linux kernel's stmmac Ethernet driver as shipped in Red Hat Enterprise Linux 8, 9, and 10 (including the Real Time kernel and the RHEL CoreOS kernels used by OpenShift 4) and in RHIVOS 2. On network interfaces based on the XGMAC2 MAC core, sustained heavy receive traffic can exhaust the DMA receive buffer descriptors; because the RX Buffer Unavailable (RBUE) interrupt is enabled in the driver's default interrupt masks, the hardware then fires it continuously until software refills the descriptor ring. The RBUE handler provides no recovery beyond the normal RX completion path, so the resulting interrupt storm monopolizes processor resources and can cause severe performance degradation or system unresponsiveness. Reliable triggering depends on XGMAC2-based stmmac hardware and sufficient receive pressure. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable code is not present in those releases. The fix is currently deferred for the affected products, so until a fixed kernel is delivered, systems with XGMAC2-based stmmac interfaces remain at residual risk of RX interrupt storms and the resulting loss of availability under heavy receive load. Red Hat assesses this flaw as MODERATE severity with a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), which is lower than the CVEORG score of 7.5 that assumes a remote, unauthenticated network attack vector.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.