CVE-2026-68120

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> rtase: Workaround for TX hang caused by hardware packet parsing<br /> <br /> The hardware performs packet parsing before packet transmission.<br /> Parsing incomplete IPv4, IPv6, TCP, or UDP headers may trigger a TX<br /> hang because the hardware parser expects additional protocol header<br /> data that is not present in the packet.<br /> <br /> The hardware performs additional PTP parsing on UDP packets identified<br /> by destination ports 319/320 at the expected UDP destination port<br /> offset.<br /> <br /> If such a packet has transport data smaller than RTASE_MIN_PAD_LEN,<br /> the hardware parser expects additional packet data and may trigger a<br /> TX hang.<br /> <br /> To avoid these hardware issues, the driver applies the following<br /> workarounds.<br /> <br /> Drop malformed packets that may trigger this hardware issue before<br /> transmission.<br /> <br /> For IPv4 non-initial fragments, the hardware does not check the<br /> fragment offset before parsing the expected transport header location.<br /> As a result, these packets are still subject to transport header<br /> parsing even though they do not contain a transport header. If the<br /> transport data is shorter than the minimum transport header required<br /> by the hardware parser, pad the transport data to the minimum<br /> transport header length required by the hardware parser. Packets that<br /> also match the hardware PTP parsing conditions continue to follow the<br /> corresponding workaround.<br /> <br /> For IPv6 fragmented packets, neither of the above hardware issues<br /> occurs because the hardware only continues packet parsing when the<br /> IPv6 Base Header Next Header field directly indicates UDP. Packets<br /> carrying a Fragment Header do not continue through the subsequent<br /> packet parsing stages.<br /> <br /> For packets identified for hardware PTP parsing, pad the transport<br /> data so it reaches RTASE_MIN_PAD_LEN before transmission.