BlackTreeIndependent security intelligence

Full vulnerability report · 2026

CVE-2025-71093High confidence

e1000: fix OOB in e1000_tbi_should_accept()

Linux · Linux

9.1CriticalCVSS 3.1

Recommended action

Within 72 hours

Critical technical impact with a remotely reachable, unauthenticated path; no CISA KEV confirmation is currently recorded.

Patch available

Distribution package intelligence

Ubuntu vendor package status

Canonical’s release and source-package findings are shown separately from local repository availability.

20 package states

Repository candidate not checked

A published vendor fix does not prove that a matching update is enabled and installable on a particular asset. Confirm the local package candidate before scheduling remediation.

Ubuntu release	Source package	Vendor state	Fixed version	Evidence
Ubuntu 24.04 LTSnoble · standard archive	`linux`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 10 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-aws`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 10 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-azure`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 10 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-azure-fde`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 10 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-azure-nvidia`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 10 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-gcp`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 10 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-gke`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 10 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-gkeop`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 10 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-ibm`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 10 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-lowlatency`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 10 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-nvidia`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 10 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-nvidia-lowlatency`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 10 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-nvidia-tegra`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 10 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-oem-6.11`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 10 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-oracle`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 10 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-raspi`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 10 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-raspi-realtime`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 10 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-realtime`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 10 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-riscv`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 10 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-xilinx`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 10 Sept 2026

Official European source

ENISA European Vulnerability Database

Official EUVD identifiers, advisory evidence and known-exploited context. Missing fields are not treated as evidence of low risk.

1 current

ENISA EUVD identifier

EUVD-2026-2245

No EUVD known-exploited evidence

ENISA has published the identifier mapping but no EUVD description has been stored yet.

EUVD state: Present in the current official mapping
Known exploitation: Not present in the current ENISA EUVD known-exploited dataset. This is not proof of no exploitation.
ENISA score: Not supplied in the stored EUVD record
Advisory evidence: No linked advisory details stored yet

Recommended actionWithin 72 hours

Critical technical impact with a remotely reachable, unauthenticated path; no CISA KEV confirmation is currently recorded.

Patch available

What, why and how

In the Linux kernel, the following vulnerability has been resolved: e1000: fix OOB in e1000_tbi_should_accept() In e1000_tbi_should_accept() we read the last byte of the frame via 'data[length - 1]' to evaluate the TBI workaround. If the descriptor- reported length is zero or larger than the actual RX buffer size, this read goes out of bounds and can hit unrelated slab objects. The issue is observed from the NAPI receive path (e1000_clean_rx_irq): ================================================================== BUG: KASAN: slab-out-of-bounds in e1000_tbi_should_accept+0x610/0x790 Read of size 1 at addr ffff888014114e54 by task sshd/363 CPU: 0 PID: 363 Comm: sshd Not tainted 5.18.0-rc1 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 Call Trace: <IRQ> dump_stack_lvl+0x5a/0x74 print_address_description+0x7b/0x440 print_report+0x101/0x200 kasan_report+0xc1/0xf0 e1000_tbi_should_accept+0x610/0x790 e1000_clean_rx_irq+0xa8c/0x1110 e1000_clean+0xde2/0x3c10 __napi_poll+0x98/0x380 net_rx_action+0x491/0xa20 __do_softirq+0x2c9/0x61d do_softirq+0xd1/0x120 </IRQ> <TASK> __local_bh_enable_ip+0xfe/0x130 ip_finish_output2+0x7d5/0xb00 __ip_queue_xmit+0xe24/0x1ab0 __tcp_transmit_skb+0x1bcb/0x3340 tcp_write_xmit+0x175d/0x6bd0 __tcp_push_pending_frames+0x7b/0x280 tcp_sendmsg_locked+0x2e4f/0x32d0 tcp_sendmsg+0x24/0x40 sock_write_iter+0x322/0x430 vfs_write+0x56c/0xa60 ksys_write+0xd1/0x190 do_syscall_64+0x43/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f511b476b10 Code: 73 01 c3 48 8b 0d 88 d3 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d f9 2b 2c 00 00 75 10 b8 01 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 8e 9b 01 00 48 89 04 24 RSP: 002b:00007ffc9211d4e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000004024 RCX: 00007f511b476b10 RDX: 0000000000004024 RSI: 0000559a9385962c RDI: 0000000000000003 RBP: 0000559a9383a400 R08: fffffffffffffff0 R09: 0000000000004f00 R10: 0000000000000070 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffc9211d57f R14: 0000559a9347bde7 R15: 0000000000000003 </TASK> Allocated by task 1: __kasan_krealloc+0x131/0x1c0 krealloc+0x90/0xc0 add_sysfs_param+0xcb/0x8a0 kernel_add_sysfs_param+0x81/0xd4 param_sysfs_builtin+0x138/0x1a6 param_sysfs_init+0x57/0x5b do_one_initcall+0x104/0x250 do_initcall_level+0x102/0x132 do_initcalls+0x46/0x74 kernel_init_freeable+0x28f/0x393 kernel_init+0x14/0x1a0 ret_from_fork+0x22/0x30 The buggy address belongs to the object at ffff888014114000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 1620 bytes to the right of 2048-byte region [ffff888014114000, ffff888014114800] The buggy address belongs to the physical page: page:ffffea0000504400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14110 head:ffffea0000504400 order:3 compound_mapcount:0 compound_pincount:0 flags: 0x100000000010200(slab|head|node=0|zone=1) raw: 0100000000010200 0000000000000000 dead000000000001 ffff888013442000 raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected ================================================================== This happens because the TBI check unconditionally dereferences the last byte without validating the reported length first: u8 last_byte = *(data + length - 1); Fix by rejecting the frame early if the length is zero, or if it exceeds adapter->rx_buffer_len. This preserves the TBI workaround semantics for valid frames and prevents touching memory beyond the RX buffer.

What

Why

The product reads data past the end, or before the beginning, of the intended buffer.

How

An attacker operating through a network path may attempt exploitation without authentication or user interaction. If successful, the issue may cause the confidentiality, integrity or availability impact described by the vendor.

What

Why

The product reads data past the end, or before the beginning, of the intended buffer.

How

Exploit reality and attack path

CVSS severity, EPSS forecast probability, public exploit material and CISA-confirmed exploitation are separate signals.

Observed exploitation

Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.

No confirmed evidence

No CISA KEV match was present at the last successful refresh. This means no confirmation from that source, not proof of no exploitation.

Public PoC / exploit material

Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.

None recorded

No exploit-tagged reference or CISA SSVC proof-of-concept state is currently recorded. Research may still exist outside the structured feeds.

Likely attack path: a network path → Out-of-bounds Read → cause the confidentiality, integrity or availability impact described by the vendor
Attack surface: Network
Privileges required: None: unauthenticated exploitation is possible
User interaction: None
Attack complexity: Low: no specialised conditions are recorded
Security boundary: Unchanged: impact remains within the vulnerable component's security authority
Weakness ? CWE means Common Weakness Enumeration: a standard category for the underlying weakness.: CWE-125 ↗
CWE-125: Out-of-bounds Read. The product reads data past the end, or before the beginning, of the intended buffer.
CVSS vector ? CVSS means Common Vulnerability Scoring System. The vector records the metric values used to calculate technical severity.: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Common Vulnerability Scoring System 3.1: the compact vector below is decoded into plain language.
AVNetworkAttack vector: The vulnerable component can be reached over a network.ACLowAttack complexity: No specialised conditions are required beyond attacker-controlled input.PRNonePrivileges required: The attacker does not need an account or existing privileges.UINoneUser interaction: No action by another user is required.SUnchangedScope: The security impact remains within the vulnerable component's authority.CHighConfidentiality impact: A successful attack can cause a major loss.INoneIntegrity impact: No direct loss is represented by this metric.AHighAvailability impact: A successful attack can cause a major loss.
Post-exploitation / living off the land: No specific living-off-the-land technique is confirmed in the structured sources. Monitor normal administration tools for activity inconsistent with the affected service's baseline.

NetworkUnauthenticatedCWE-125

Official authority intelligence

Only matched European and national findings are included. Language selectors and unavailable sources are omitted.

ENISA EUVD · EUVD-2026-2245Official EUVD mapping

0 linked advisory records.

Official EUVD record

BSI · German · WID-SEC-W-2026-0086Linux Kernel: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen um nicht näher spezifizierte Angriffe durchzuführen, die möglicherweise zu einer Denial-of-Service- Bedingung führen oder eine Speicherbeschädigung verursachen können.

e1000: fix OOB in e1000_tbi_should_accept()

National CERT insights ?CERT means Computer Emergency Response Team; CSIRT is the closely related term Computer Security Incident Response Team.

EUVD-2026-2245

What, why and how

Exploit reality and attack path

Official authority intelligence

Patch and workaround

Evidence and provenance

National CERT insights
?
CERT means Computer Emergency Response Team; CSIRT is the closely related term Computer Security Incident Response Team.