{"id":"CVE-2026-98574","revision":"d0107ffeef0246ba94ed978814f4ff68","records":[{"revision":"d0107ffeef0246ba94ed978814f4ff68","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98574","aliases":[],"title":"net: bcmgenet: stop Tx NAPI before disabling the queues","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bcmgenet: stop Tx NAPI before disabling the queues\n\nbcmgenet_netif_stop() and the Wake-on-LAN branch of bcmgenet_suspend()\nboth disable the Tx queues first and stop Tx NAPI several steps later. A\ncompletion in flight calls netif_tx_wake_queue() in between, and nothing\nstops the queue again, so a transmit can reach the rings after they have\nbeen freed.\n\nClose is safe because dev_deactivate_many() stops the qdisc first.\nbcmgenet_suspend() does not, so stop Tx NAPI before the queues on both\npaths.\n\nKASAN on a Raspberry Pi CM4, driven from an MTU change because suspend\nfreezes user space before the callback runs:\n\n  BUG: KASAN: use-after-free in bcmgenet_xmit+0x17f8/0x2258\n  Write of size 8 at addr ffffff8055844a68 by task ksoftirqd/0/14\n   bcmgenet_xmit+0x17f8/0x2258\n   dev_hard_start_xmit+0x13c/0x588\n   sch_direct_xmit+0x108/0x340\n   __dev_queue_xmit+0x1190/0x3848","state":0,"publishedAt":"2026-10-18T15:18:39.767+00:00","modifiedAt":"2026-10-19T09:21:59.645+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/ethernet/broadcom/genet/bcmgenet.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"254f3239dd070e469f45c3ca8b6ac38e47d6c730\",\n                            \"lessThan\": \"63bcc2fee6419963e45e7c2cd698fa862409601d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"254f3239dd070e469f45c3ca8b6ac38e47d6c730\",\n                            \"lessThan\": \"f329d42423089904758f2685cda295de9bf99441\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"254f3239dd070e469f45c3ca8b6ac38e47d6c730\",\n                            \"lessThan\": \"7e87508b5c4d81210d0a736ed01962e52f5c4c56\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/ethernet/broadcom/genet/bcmgenet.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.15\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.15\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.55\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.9\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/63bcc2fee6419963e45e7c2cd698fa862409601d","https://git.kernel.org/stable/c/f329d42423089904758f2685cda295de9bf99441","https://git.kernel.org/stable/c/7e87508b5c4d81210d0a736ed01962e52f5c4c56"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98574","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98574","identifiers":["CVE-2026-98574"]},"retained":false,"historicalAffected":[]}],"coverage":[]}