CVE-2026-90591

The NXP ENET-QOS Ethernet driver's receive work handler eth nxp enet qos rx() in drivers/ethernet/eth nxp enet qos hands each processed descriptor back to the DMA by writing desc->read.control = rx desc refresh flags, which sets OWN FLAG and BUF1 ADDR VALID FLAG. RDES0 of a receive descriptor is the DMA buffer address in read format, but the hardware write-back aliases that word with the VLAN tag fields (or, for a context descriptor, the timestamp low word), so it is destroyed on every completion. The success path rewrites desc->read.buf1 addr before re-arming; the four drop paths — errored or non-first descriptor, net pkt rx alloc() failure, invalid descriptor length, and net pkt get frag() failure — did not, re-arming the ring slot with the write-back residue as its DMA target address.

The drop paths are driven entirely by received traffic and need no privilege or special configuration. With the defaults for this driver (CONFIG NET BUF DATA SIZE of 128 and 16 receive descriptors) a single full-size frame consumes twelve ring slots and twelve K NO WAIT fragment allocations, so a short burst of frames sent to the device exhausts the receive pools and reaches the allocation-failure paths; a frame with a receive error, or any frame whose first descriptor was already dropped, reaches the non-first-descriptor path.

Once a slot has been poisoned, the DMA writes the next frame received in that slot to an address derived from the frame's VLAN tag fields rather than to a receive buffer. On the supported MCX SoCs that address falls in flash or reserved space, so the transfer raises a fatal bus error that the driver only logs — there is no reset or recovery path — and reception stops permanently until the device is rebooted; where the write is silently discarded instead, the untouched buffer is later handed to the network stack with a length, delivering stale buffer contents as if they were a received frame. A single triggering event is enough to make the condition persistent, so an attacker able to send traffic to the device can permanently disable its network interface.