Executive brief
A vulnerability in the Linux kernel's Broadcom GENET network driver could lead to system instability or network service disruptions. When a single network transmission queue times out, the system incorrectly attempts to shut down all active queues, creating a race condition that can crash the network interface. This affects systems using specific Broadcom Ethernet controllers, potentially impacting network availability.
Technical details
A race condition exists in the bcmgenet_timeout handler within the Broadcom GENET Ethernet driver (drivers/net/ethernet/broadcom/genet/bcmgenet.c). The handler was designed to take down all transmit (TX) queues when a single queue timed out, which is overly aggressive and conflicts with queues that are still processing data. This mismatch leads to race conditions during queue reclamation and interrupt re-enabling. An attacker or a high-load network scenario could trigger this timeout, leading to a denial-of-service (DoS) of the network interface. The fix modifies the handler to only restart and reclaim the specific timed-out queue rather than the entire interface.
Affected products
- Linux Linux Kernel 4.2 to 7.0.10
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory
References
- https://git.kernel.org/stable/c/5393b2b5bee2ac51a0043dc7f4ac3475f053d08d
- https://git.kernel.org/stable/c/681fdfe823b4f1036ed50b58b8838c7917ea389c
- https://git.kernel.org/stable/c/7ce1c26aac3b318886a57425f64b522da7389153
- https://git.kernel.org/stable/c/c270e2bec3e55a716d25c35341091339457ac883
- https://git.kernel.org/stable/c/e8206538cbaf4f4068e99a4cb1138690a1e00499
- https://git.kernel.org/stable/c/e85b0c0a12e967930044608311471b665baa315c