am65-cpsw PortId OOB

Vulnerability analysis

The TI AM65x/J721E CPSW Ethernet driver extracts the MAC port identifier from a 16-bit Source Tag field in the receive DMA descriptor metadata, but only the lower 8 bits represent the actual port ID — the upper 8 bits are hardware-reserved and contain arbitrary values set by the hardware. Using the full 16-bit value as an index into the port array causes sporadic out-of-bounds memory accesses, resulting in kernel crashes. The fix masks the Source Tag to its lower 8 bits before using it as a port index, ensuring only the valid portion of the field is used. The vulnerable code path is the packet reception handler, reached whenever the network interface processes incoming traffic; any network participant who can send packets to the device's Ethernet interface can trigger the receive path, though the crash itself is sporadic and depends on hardware state rather than packet content. This issue requires specific TI AM65x/J721E SoC hardware with the CPSW NUSS Ethernet subsystem active.