Executive brief
A vulnerability was identified in the Linux kernel's Broadcom GENET network driver. When the system attempts to clear out the network transmission queue, it fails to properly track available memory resources and notify the networking subsystem about dropped data. This could lead to resource exhaustion or inconsistent network states on affected hardware.
Technical details
A vulnerability in the bcmgenet driver (drivers/net/ethernet/broadcom/genet/bcmgenet.c) occurs during the tx queue reclamation process. When the driver fast-forwards the write pointer to drop in-flight data, it fails to increment the free buffer descriptor (BD) count and does not call netdev_tx_reset_queue to synchronize the state with the network stack. This results in a leak of free_bds and potential inconsistencies in the netdev queue state. The issue was introduced in the logic supporting the reclamation of unsent Tx packets and has been patched in multiple stable branches including 6.18.33 and 7.0.10.
Affected products
- Linux Linux 6.15 to 7.1
Timeline
- 2026-04-06: other: Patch authored
- 2026-06-24: advisory: CVE published
References
- https://git.kernel.org/stable/c/150d06aae1839a6564ab200ef0e7291c3528bbb0
- https://git.kernel.org/stable/c/25ff3a3e47ea635ec08dc93e84dd2bfe15abfebb
- https://git.kernel.org/stable/c/3c3abbcfa05bad17965498ff7cc94c2418fa94b3
- https://git.kernel.org/stable/c/3f3168300efb839028328d720ab3962f91d6a0d0
- https://git.kernel.org/stable/c/52b9f80993698138b90e5ca3a72550a2501f2a96
- https://git.kernel.org/stable/c/ac4a29c331ecb5b10240c44247a8e010c95bc15b