-

CVE-2026-98574

net: bcmgenet: stop Tx NAPI before disabling the queues

In the Linux kernel, the following vulnerability has been resolved:

net: bcmgenet: stop Tx NAPI before disabling the queues

bcmgenet_netif_stop() and the Wake-on-LAN branch of bcmgenet_suspend()
both disable the Tx queues first and stop Tx NAPI several steps later. A
completion in flight calls netif_tx_wake_queue() in between, and nothing
stops the queue again, so a transmit can reach the rings after they have
been freed.

Close is safe because dev_deactivate_many() stops the qdisc first.
bcmgenet_suspend() does not, so stop Tx NAPI before the queues on both
paths.

KASAN on a Raspberry Pi CM4, driven from an MTU change because suspend
freezes user space before the callback runs:

  BUG: KASAN: use-after-free in bcmgenet_xmit+0x17f8/0x2258
  Write of size 8 at addr ffffff8055844a68 by task ksoftirqd/0/14
   bcmgenet_xmit+0x17f8/0x2258
   dev_hard_start_xmit+0x13c/0x588
   sch_direct_xmit+0x108/0x340
   __dev_queue_xmit+0x1190/0x3848
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version 254f3239dd070e469f45c3ca8b6ac38e47d6c730
Version < 63bcc2fee6419963e45e7c2cd698fa862409601d
Status affected
Version 254f3239dd070e469f45c3ca8b6ac38e47d6c730
Version < f329d42423089904758f2685cda295de9bf99441
Status affected
Version 254f3239dd070e469f45c3ca8b6ac38e47d6c730
Version < 7e87508b5c4d81210d0a736ed01962e52f5c4c56
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 6.15
Status affected
Version 0
Version < 6.15
Status unaffected
Version <= 6.18.*
Version 6.18.55
Status unaffected
Version <= 7.2.*
Version 7.2.9
Status unaffected
Version <= *
Version 7.3
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.2% 0.09
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/63bcc2fee6419963e45e7c2cd698fa862409601d
https://git.kernel.org/stable/c/f329d42423089904758f2685cda295de9bf99441
https://git.kernel.org/stable/c/7e87508b5c4d81210d0a736ed01962e52f5c4c56