CVE-2026-64587net: ethernet: arc: emac: quiesce interrupts before requesting IRQ
- 7.0HighCVSS base score
- 0.16%Exploitation in 30 daysEPSS · top 95% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: arc: emac: quiesce interrupts before requesting IRQ Normal RX/TX interrupts are enabled later, in arc_emac_open(), so probe should not see interrupt delivery in the usual case. However, hardware may still present stale or latched interrupt status left by firmware or the bootloader. If probe later unwinds after devm_request_irq() has installed the handler, such a stale interrupt can still reach arc_emac_intr() during teardown and race with release of the associated net_device. Avoid that window by putting the device into a known quiescent state before requesting the IRQ: disable all EMAC interrupt sources and clear any pending EMAC interrupt status bits. This keeps the change hardware-focused and minimal, while preventing spurious IRQ delivery from leftover state.
Timeline
ID reserved
By Linux
- 18 days later
· 18 days later
Published
- 2 days later
· 2 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.0 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Received | 3.1 | High7.0 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.16% · top 95% of all CVEs (14 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.0.
Affected products
- affected e4f2379db6c6823c5d4a4c2c912df00c65de51d7 – < abd338da658d7faa8e26cfefc8f83f0066707564
- affected e4f2379db6c6823c5d4a4c2c912df00c65de51d7 – < 5f29dd540fe5ea3c826fc8ec759ba488b31f9707
- affected e4f2379db6c6823c5d4a4c2c912df00c65de51d7 – < 6fc7449773748c7b904235a09a67054d78ab1172
- affected e4f2379db6c6823c5d4a4c2c912df00c65de51d7 – < 81431da777924dddaefa5c9b0ca9da4a93f9df96
- affected e4f2379db6c6823c5d4a4c2c912df00c65de51d7 – < d0f2386f529807826e7404d40a245ee428f89f62
- affected e4f2379db6c6823c5d4a4c2c912df00c65de51d7 – < 8efd5dcd31e22a9308b16b107a052fcd568c0a99
- affected e4f2379db6c6823c5d4a4c2c912df00c65de51d7 – < 8f9adb3605e36f75639de529bb3d66e94194a388
- affected e4f2379db6c6823c5d4a4c2c912df00c65de51d7 – < 2503d08f8a2de618e5c3a8183b250ff4a2e2d52c
- affected 3.11
- unaffected < 3.11
- unaffected 5.10.253 – ≤ 5.10.*
- unaffected 5.15.203 – ≤ 5.15.*
- unaffected 6.1.167 – ≤ 6.1.*
- unaffected 6.6.130 – ≤ 6.6.*
- unaffected 6.12.78 – ≤ 6.12.*
- unaffected 6.18.19 – ≤ 6.18.*
- unaffected 6.19.9 – ≤ 6.19.*
- unaffected 7.0 – ≤ *
References
References8
- https://git.kernel.org/stable/c/abd338da658d7faa8e26cfefc8f83f0066707564 (opens in a new tab)
- https://git.kernel.org/stable/c/5f29dd540fe5ea3c826fc8ec759ba488b31f9707 (opens in a new tab)
- https://git.kernel.org/stable/c/6fc7449773748c7b904235a09a67054d78ab1172 (opens in a new tab)
- https://git.kernel.org/stable/c/81431da777924dddaefa5c9b0ca9da4a93f9df96 (opens in a new tab)
- https://git.kernel.org/stable/c/d0f2386f529807826e7404d40a245ee428f89f62 (opens in a new tab)
- https://git.kernel.org/stable/c/8efd5dcd31e22a9308b16b107a052fcd568c0a99 (opens in a new tab)
- https://git.kernel.org/stable/c/8f9adb3605e36f75639de529bb3d66e94194a388 (opens in a new tab)
- https://git.kernel.org/stable/c/2503d08f8a2de618e5c3a8183b250ff4a2e2d52c (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-53774 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-64587)Record last updated .