CVE-2026-90591

{
  "etk_id": "ETK-2026-3999",
  "cve_id": "CVE-2026-90591",
  "display_id": "CVE-2026-90591",
  "ghsa_id": "GHSA-pm7x-98w8-92pm",
  "euvd_id": "EUVD-2026-120492",
  "status": "published",
  "anchor_state": "anchored",
  "title": "DMA descriptor reinitialization flaw in Zephyr ENET-QOS driver",
  "summary": "Zephyr systems using the NXP ENET-QOS Ethernet driver may mishandle receive descriptors after certain incoming frames are dropped. An attacker able to send traffic to the affected interface can cause network reception to stop until reboot; on platforms that discard the resulting DMA write, stale buffer contents may be passed to the network stack. No authentication or unusual device configuration is required beyond network reachability to that interface.",
  "mitigation": "Update Zephyr to 4.3.2 or 4.5.0, as appropriate for the maintained release line. Until updated, restrict untrusted traffic from reaching interfaces that use the NXP ENET-QOS driver.",
  "vendor": "zephyrproject",
  "product": "zephyr",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 4.2.0, < 4.3.2"
      ],
      "ecosystem": "other",
      "fixed_versions": [
        "4.3.2"
      ],
      "package_name": "zephyr",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 4.4.0, < 4.5.0"
      ],
      "ecosystem": "other",
      "fixed_versions": [
        "4.5.0"
      ],
      "package_name": "zephyr",
      "purl": null
    }
  ],
  "cwes": [
    787
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 9.161698066666666,
  "t0_at": "2026-11-09T22:04:03.975000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-09T22:04:03.975000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-09T22:04:03.975000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-90591"
    }
  }
}