# CVE-2026-93830: net: stmmac: xgmac2: disable RBUE in default RX interrupt mask

> An attacker can cause a MAC interrupt storm under heavy RX pressure, leading to denial of service in the Linux kernel stmmac driver.

- **Severity:** High 7.5 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 24 Sep 2026
- **Updated:** 3 Oct 2026
- **Also known as:** AZL-103920, BELL-CVE-2026-93830, DEBIAN-CVE-2026-93830, GHSA-qh7q-28pc-c4hv, UBUNTU-CVE-2026-93830

## What is CVE-2026-93830?

CVE-2026-93830 is a high-severity denial of service vulnerability in Linux, published on 24 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

net: stmmac: xgmac2: disable RBUE in default RX interrupt mask

Enabling the RX Buffer Unavailable (RBUE) interrupt is counterproductive
and can trigger a MAC interrupt storm under heavy RX pressure. When the
DMA runs out of RX descriptors it fires RBUE continuously until software
refills the ring.

However, RBUE is redundant: the normal RX completion interrupt (RIE)
already triggers NAPI, which processes completed descriptors and refills
the ring, causing the DMA to resume. The RBUE handler itself only sets
handle_rx - the same outcome as RIE.

On Agilex5 under heavy RX pressure, the MAC interrupt (which includes
RBUE) was observed firing 1,821,811,555 times against only 2,618,627
actual RX completions - a ~695x ratio - confirming the severity of the
storm.

RBUE does not provide OOM recovery. If page_pool is exhausted,
stmmac_rx_refill() cannot advance the DMA tail pointer, the DMA stays
suspended, and RBUE fires again on the next NAPI completion - a storm
with no forward progress. This patch trades that storm for a clean
stall with the same RX outcome. Proper OOM recovery is a pre-existing
gap outside the scope of this fix.

Note: as a consequence of disabling RBUE, the rx_buf_unav_irq ethtool
counter will always read 0 on XGMAC2 devices. This behaviour is already
inconsistent across DWMAC core versions.

Remove RBUE from XGMAC_DMA_INT_DEFAULT_EN and XGMAC_DMA_INT_DEFAULT_RX
to prevent the interrupt storm while keeping normal RX handling intact.

## Which versions are affected by CVE-2026-93830?


## How do I fix CVE-2026-93830?

Apply the vendor's patch.

## Is CVE-2026-93830 being exploited?

There is no known exploitation of CVE-2026-93830 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-93830 and fix it if it is affected.

What it is: CVE-2026-93830 is a high-severity denial of service vulnerability in Linux, published on 24 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-93830 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-93830/ (Markdown: https://insights.sbomify.com/CVE-2026-93830/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-93830
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-93830
- OSV: https://osv.dev/vulnerability/CVE-2026-93830

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-93830/
Summaries are generated and may contain mistakes; the official description above is the record.