{"id":"CVE-2026-98798","kind":"vulnerability","aliases":["CVE-2026-98798"],"related":[],"title":"Linux kernel: bcmgenet ethtool coalesce setting on closed interface crashes kernel","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bcmgenet: fix NULL dereference in set_coalesce before first open\n\nThe Rx ring priv and index are only set in bcmgenet_init_rx_ring(),\nwhich runs at open. Setting the Rx coalescing parameters on an interface\nthat was never opened, e.g. \"ethtool -C eth0 rx-usecs 50\", dereferences\na NULL ring->priv. The oops happens with RTNL held, so networking\nstays stuck until a reboot:\n\n  Unable to handle kernel paging request at virtual address 0000000000002788\n  pc : bcmgenet_set_rx_coalesce.isra.0+0x10/0x88\n  lr : bcmgenet_set_coalesce+0xe8/0x180\n  Call trace:\n   bcmgenet_set_rx_coalesce.isra.0+0x10/0x88 (P)\n   __ethnl_set_coalesce.isra.0+0x490/0x570\n   ethnl_set_coalesce+0x48/0xc0\n   ethnl_default_set_doit+0xf4/0x230\n   genl_family_rcv_msg_doit+0xe8/0x160\n   genl_rcv_msg+0x220/0x2a0\n   netlink_rcv_skb+0x68/0x140\n   genl_rcv+0x40/0x60\n   netlink_unicast+0x338/0x3c0\n   netlink_sendmsg+0x19c/0x3f8\n   __sock_sendmsg+0x64/0xc0\n   __sys_sendto+0x124/0x198\n   __arm64_sys_sendto+0x30/0x48\n\nSet priv and index at probe. Writing the registers while the interface\nis down is harmless because open resets the MAC and\nbcmgenet_init_rx_coalesce() reapplies the stored values.\n\nIt was observed on a Raspberry Pi CM4, but should apply to all other\ngenet devices.","summary":"Setting Rx coalescing parameters with ethtool on a bcmgenet Ethernet interface that was never opened dereferences a NULL ring pointer, causing a kernel oops. The oops happens with RTNL held, so networking stays stuck until reboot.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["arm64","bcmgenet","linux-kernel","raspberry-pi","runtime"],"not_affected_if":["no-bcmgenet-hardware"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-18T16:17:33+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:15:06+00:00","updated_at":"2026-10-25T05:15:06+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:15:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: bcmgenet ethtool coalesce setting on closed interface crashes kernel","impact":"low","summary":"Setting Rx coalescing parameters with ethtool on a bcmgenet Ethernet interface that was never opened dereferences a NULL ring pointer, causing a kernel oops. The oops happens with RTNL held, so networking stays stuck until reboot.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","raspberry-pi","bcmgenet","arm64"],"confidence":0.6,"needs_auth":"yes","worst_case":"kernel oops halts networking until reboot","analyst_note":"","how_to_check":"unknown","needs_analyst":false,"not_affected_if":["no-bcmgenet-hardware"],"who_is_affected":"Systems running Linux kernels with the Broadcom bcmgenet driver, such as Raspberry Pi CM4 and other GENET-based devices. The crash needs a local user or process able to run ethtool or send the netlink coalesce request against an interface that has not yet been brought up. Systems without bcmgenet hardware are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.00061,"input_tokens":3869,"output_tokens":446,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':153C,159C,165C,170C,175C,181C,188C,193C,198C,202C,206C,210C,214C,218C,223C '-2026':13A,16A '-98798':14A,17A '0':152C,164C,169C '0000000000002788':149C '50':121C 'address':148C 'appli':265C 'arm64':18B,220C 'bcmgenet':3A,19B,35B,74C,94C,156C,247C 'bcmgenet_set_rx_coalesce.isra':151C,163C 'c':116C 'call':161C 'caus':47B 'close':8A 'cm4':262C 'coalesc':5A,29B,80C,105C,158C,174C,250C 'crash':10A 'cve':12A,15A 'default':178C 'derefer':42B,77C,122C 'devic':270C 'doit':180C,187C 'e.g':114C 'eth0':117C 'ethernet':36B 'ethnl':172C,177C 'ethnl_set_coalesce.isra':168C 'ethtool':4A,32B,115C 'famili':184C 'first':82C 'fix':75C 'follow':68C 'genet':269C 'genl':183C,190C,200C 'handl':142C 'happen':53B,129C 'harmless':240C 'held':56B,132C 'index':89C,228C 'init':95C,248C 'interfac':9A,37B,109C,236C 'kernel':2A,11A,22B,49B,66C,143C 'linux':1A,21B,65C 'linux-kernel':20B 'lr':155C 'mac':245C 'msg':186C,192C 'net':73C 'netlink':195C,204C,208C 'network':58B,134C 'never':40B,112C 'null':44B,76C,124C 'observ':257C 'oop':50B,52B,128C 'open':41B,83C,101C,113C,242C 'p':167C 'page':144C 'paramet':30B,106C 'pc':150C 'pi':25B,261C 'pointer':46B 'priv':87C,126C,226C 'probe':230C 'raspberri':24B,260C 'raspberry-pi':23B 'rcv':185C,191C,196C,201C 'reappli':251C 'reboot':62B,139C 'regist':233C 'request':145C 'reset':243C 'resolv':72C 'ring':45B,86C,97C,125C 'rtnl':55B,131C 'run':99C 'runtim':26B 'rx':28B,85C,96C,104C,119C,249C 'rx-usec':118C 'sendmsg':209C,213C 'sendto':217C,222C 'set':6A,27B,79C,92C,102C,157C,173C,179C,225C 'skb':197C 'sock':212C 'stay':59B,135C 'store':253C 'stuck':60B,136C 'sys':216C,221C 'trace':162C 'unabl':140C 'unicast':205C 'usec':120C 'valu':254C 'virtual':147C 'vulner':69C 'write':231C 'x10/0x88':154C,166C 'x124/0x198':219C 'x19c/0x3f8':211C 'x220/0x2a0':194C 'x30/0x48':224C 'x338/0x3c0':207C 'x40/0x60':203C 'x48/0xc0':176C 'x490/0x570':171C 'x64/0xc0':215C 'x68/0x140':199C 'xe8/0x160':189C 'xe8/0x180':160C 'xf4/0x230':182C","nicknames":[],"mitigations":[],"who_affected":"Systems running Linux kernels with the Broadcom bcmgenet driver, such as Raspberry Pi CM4 and other GENET-based devices. The crash needs a local user or process able to run ethtool or send the netlink coalesce request against an interface that has not yet been brought up. Systems without bcmgenet hardware are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:33+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98798","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98798","severity":null,"published_at":"2026-10-18T16:17:33+00:00","modified_at":"2026-10-21T13:21:47+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}