In the Linux kernel, the following vulnerability has been resolved:
net: ethernet: ti: icssg: guard PA stat lookups
icssgndogetstats64() unconditionally calls emacgetstatbyname()
with FW PA stat names regardless of whether the PA stats block is
present on the hardware. emacgetstatbyname() already guards the
PA stats lookup with if (emac->prueth->pa_stats); when that pointer
is NULL the lookup falls through to netdeverr() and returns -EINVAL.
Because ndogetstats64 is polled regularly by the networking stack
this produces thousands of log entries of the form:
icssg-prueth icssg1-eth end0: Invalid stats FWRXERROR
A secondary consequence is that the int(-EINVAL) return value is
implicitly widened to a near-ULLONG_MAX unsigned value when accumulated
into the _u64 fields of rtnllinkstats64, silently corrupting the
rxerrors, rxdropped and txdropped counters reported by ip -s link.
Every other PA-aware code path in the driver is already guarded with
the same if (emac->prueth->pa_stats) check. Apply the same guard
here.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72060.json"
}