Live › vulnerability › CVE-2026-98574
Go to dashboardIn the bcmgenet Ethernet driver, the Tx queues are disabled before Tx NAPI is stopped during close-less paths such as Wake-on-LAN suspend, so a completion can wake the queue and a transmit can write to freed rings. The sources show a KASAN use-after-free write in bcmgenet_xmit on a Raspberry Pi CM4, which can corrupt kernel memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with the bcmgenet Ethernet driver, such as Raspberry Pi 4 and CM4 boards, are exposed, and the bug is reached through interface MTU changes and suspend with Wake-on-LAN enabled. Desktop or server machines with other NICs are not affected. The sources do not say whether a remote attacker can trigger the transmit path.
No product ranges from the sources yet.
uname -r and compare against the fixed kernel in the sources, which the sources do not namelsmod | grep bcmgenet or ethtool -i eth0ethtool eth0 | grep WakeEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
net: bcmgenet: stop Tx NAPI before disabling the queues
bcmgenet_netif_stop() and the Wake-on-LAN branch of bcmgenet_suspend() both disable the Tx queues first and stop Tx NAPI several steps later. A completion in flight calls netif_tx_wake_queue() in between, and nothing stops the queue again, so a transmit can reach the rings after they have been freed.
Close is safe because dev_deactivate_many() stops the qdisc first. bcmgenet_suspend() does not, so stop Tx NAPI before the queues on both paths.
KASAN on a Raspberry Pi CM4, driven from an MTU change because suspend freezes user space before the callback runs:
BUG: KASAN: use-after-free in bcmgenet_xmit+0x17f8/0x2258 Write of size 8 at addr ffffff8055844a68 by task ksoftirqd/0/14 bcmgenet_xmit+0x17f8/0x2258 dev_hard_start_xmit+0x13c/0x588 sch_direct_xmit+0x108/0x340 __dev_queue_xmit+0x1190/0x3848
This page as .md · .json · in your agent: get_signal("CVE-2026-98574")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.