Vulnerability in NXP ENET-QOS Ethernet Driver Affecting Multiple Devices

CVE-2026-90591

What is CVE-2026-90591?

The NXP ENET-QOS Ethernet driver's receive work handler processes descriptors in a way that can lead to severe network issues. When descriptors are handled incorrectly, especially during error conditions or descriptor length issues, the driver can write to faulty memory addresses derived from VLAN tag fields. This can result in network interface disruption, including fatal bus errors. An attacker sending crafted traffic could exploit this vulnerability to disable the network interface permanently, making recovery impossible without a device reboot. This situation poses a significant risk to network reliability as it affects multiple devices when vulnerable configurations are used.

References