# CVE-2026-99188: net: stmmac: dwmac1000: clear the RGMII status interrupt


- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Fix available:** Yes
- **Published:** 28 Oct 2026
- **Updated:** 28 Oct 2026
- **Also known as:** DEBIAN-CVE-2026-99188, GHSA-42r7-qxvg-gp4f, UBUNTU-CVE-2026-99188

## What is CVE-2026-99188?

CVE-2026-99188 is a vulnerability in Linux, published on 28 Oct 2026. 

### Official description

In the Linux kernel, the following vulnerability has been resolved:

net: stmmac: dwmac1000: clear the RGMII status interrupt

Since commit 2e2c878a3141 ("net: stmmac: remove SGMII/RGMII/SMII
interrupt handling") nothing on the RGMII path reads GMAC_RGSMIIIS, so
RGSMIIIS stays pending behind GMAC_INT_MASK from the first link change
on. stmmac_resume() resets the MAC in stmmac_hw_setup(); the reset sets
GMAC_INT_MASK to 0 until dwmac1000_core_init() writes the mask again,
and the pending status storms the line:

  dwmac_dma_interrupt: unexpected status 04000000

A register dump at the first message on ODROID-HC4 showed it:

  core int_status 00000001 int_mask 00000000 pmt 00000000 rgsmiiis 0000000d

When the resume thread runs on the CPU that takes the MAC interrupt,
the storm starves it: a soft lockup, then a watchdog reset or a hang.

Read GMAC_RGSMIIIS in dwmac1000_irq_status() when the status is not
masked, as the driver did before 2e2c878a3141; the read clears it.

Wake-on-LAN resume from s2idle with the resume thread and the MAC
interrupt on one CPU: Helios64 (dwmac-rk), 7.3-rc6, soft-locked in 3 of
3 resumes without a fix and in 0 of 10 with this patch; it ran with an
out-of-tree dwmac-rk change that keeps the GMAC powered across suspend.
ODROID-HC4 (dwmac-meson8b): 0 of 10 with this patch, 2 of 2 without a
fix on a 7.3-rc5 build. irq_rgmii_n went up by one per resume.

## Which versions are affected by CVE-2026-99188?


## How do I fix CVE-2026-99188?

Upgrade to a fixed version.

## Is CVE-2026-99188 being exploited?

There is no known exploitation of CVE-2026-99188 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-99188 and fix it if it is affected.

What it is: CVE-2026-99188 is a vulnerability in Linux, published on 28 Oct 2026. 
Exploitation: There is no known exploitation of CVE-2026-99188 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-99188/ (Markdown: https://insights.sbomify.com/CVE-2026-99188/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-99188
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-99188
- OSV: https://osv.dev/vulnerability/CVE-2026-99188

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-99188/
Summaries are generated and may contain mistakes; the official description above is the record.