Executive brief
The Linux kernel's bcmgenet Ethernet driver receives network packets from hardware and allocates fixed-size buffers to store them. A malformed packet larger than the buffer size can cause a kernel panic and system crash. This vulnerability affects network devices using the bcmgenet driver, potentially allowing remote attackers to trigger a denial of service by sending oversized packets.
Technical details
The bcmgenet driver allocates 2 KiB socket buffers (SKBs) to receive Ethernet packets from the hardware. A race condition or hardware malfunction can deliver packets exceeding this nominal buffer size, triggering a kernel buffer overflow (skb_over_panic). The vulnerability exists in the bcmgenet_desc_rx() function in drivers/net/ethernet/broadcom/genet/bcmgenet.c. The fix adds an early length check before SKB allocation that drops packets exceeding RX_BUF_LENGTH, logging the event as a receive error instead of panicking. The vulnerability is reachable over the network on devices with bcmgenet Ethernet hardware and requires no authentication or user interaction.
Affected products
- Linux Linux kernel multiple versions prior to patch (2023-01-26)
Timeline
- 2023-01-26: disclosed: Patch authored by Florian Fainelli
- 2023-03-10: patched: Patch merged into stable kernel branches
- 2025-10-04: advisory