{"id":"CVE-2026-99192","kind":"vulnerability","aliases":["CVE-2026-99192"],"related":[],"title":"Linux kernel bcmgenet: shared skb stalls transmit queue until watchdog reset","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bcmgenet: unshare the skb before writing the control block\n\nbcmgenet stores first_cb, last_cb and bytes_sent in the skb control\nblock and reads them back on completion to free the skb and credit BQL.\nether_setup() leaves IFF_TX_SKB_SHARING set, so the stack can resubmit\na shared skb that is still in the ring. The next transmit overwrites\nlast_cb, so the earlier slots complete without crediting their bytes\nand BQL stalls the queue until the watchdog resets it.\n\nUnshare the skb before writing the control block.\n\nReproduce with pktgen in clone_skb mode, which hands the driver the same\nskb while earlier copies are still in the ring:\n\n  modprobe pktgen\n  pg=/proc/net/pktgen\n  echo \"add_device eth0\" > $pg/kpktgend_0\n  echo \"dst_mac AA:BB:CC:DD:EE:FF\" > $pg/eth0\n  echo \"dst 192.0.2.1\" > $pg/eth0\n  echo \"clone_skb 8\" > $pg/eth0\n  echo \"count 0\" > $pg/eth0\n  echo start > $pg/pgctrl &\n  sleep 5\n  echo stop > $pg/pgctrl\n  wait\n  cat /sys/class/net/eth0/queues/tx-0/byte_queue_limits/inflight\n\ninflight stays nonzero on the now idle queue. clone_skb 0 leaves it at\nzero.","summary":"The bcmgenet Broadcom Ethernet driver writes its control block into a socket buffer that may still be shared and queued, so earlier transmit slots never get credited and the queue stalls until the watchdog resets it. The sources describe a denial-of-service style stall triggered by resubmitted skbs, not code execution or data theft.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["broadcom-hardware","embedded","infrastructure","linux-kernel","raspberry-pi"],"not_affected_if":["no-bcmgenet-hardware","non-linux"],"how_to_check":"- Run `uname -r` and compare against the kernel build that carries the bcmgenet unshare fix; the sources do not give a fixed version.\n- Check whether the host uses the bcmgenet driver: `lsmod | grep bcmgenet` or `ethtool -i eth0`.\n- Read `/sys/class/net/eth0/queues/tx-0/byte_queue_limits/inflight` on an idle queue; a nonzero value that does not drop is the symptom described.","fix":"- Update the Linux kernel to a stable release that includes the upstream commit 'net: bcmgenet: unshare the skb before writing the control block' (fixed version unknown from the sources).\n- Until patched, watch for stalled tx queues and reset the interface if needed.","status":"open","published_at":"2026-10-28T11:17:40+00:00","first_seen_at":"2026-10-28T11:32:37+00:00","triaged_at":"2026-10-28T11:34:13+00:00","updated_at":"2026-10-28T11:34:13+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-28T11:34:13Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a stable release that includes the upstream commit 'net: bcmgenet: unshare the skb before writing the control block' (fixed version unknown from the sources).\n- Until patched, watch for stalled tx queues and reset the interface if needed.","reach":"local","title":"Linux kernel bcmgenet: shared skb stalls transmit queue until watchdog reset","impact":"low","summary":"The bcmgenet Broadcom Ethernet driver writes its control block into a socket buffer that may still be shared and queued, so earlier transmit slots never get credited and the queue stalls until the watchdog resets it. The sources describe a denial-of-service style stall triggered by resubmitted skbs, not code execution or data theft.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","raspberry-pi","broadcom-hardware","embedded"],"confidence":0.6,"needs_auth":"no","worst_case":"transmit queue stalls until watchdog resets the interface","analyst_note":"Confirm the fixed kernel version and the stable backport commit from the kernel.org CVE record for CVE-2026-99192; sources give no severity or version.","how_to_check":"- Run `uname -r` and compare against the kernel build that carries the bcmgenet unshare fix; the sources do not give a fixed version.\n- Check whether the host uses the bcmgenet driver: `lsmod | grep bcmgenet` or `ethtool -i eth0`.\n- Read `/sys/class/net/eth0/queues/tx-0/byte_queue_limits/inflight` on an idle queue; a nonzero value that does not drop is the symptom described.","needs_analyst":true,"not_affected_if":["no-bcmgenet-hardware","non-linux"],"who_is_affected":"Systems running Linux with the bcmgenet Ethernet driver, which is used on Broadcom Raspberry Pi and set-top box class hardware. The stall needs the stack to resubmit a shared skb while earlier copies are still in the ring, which the sources show with pktgen clone_skb mode. Hosts with other NICs or without bcmgenet can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000766,"input_tokens":3732,"output_tokens":785,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-99192':14A,17A '/proc/net/pktgen':212C '/sys/class/net/eth0/queues/tx-0/byte_queue_limits/inflight':251C '0':239C,262C '192.0.2.1':230C '5':245C '8':235C 'aa':221C 'add':214C 'back':122C 'bb':222C 'bcmgenet':3A,30B,96C,105C 'block':37B,104C,118C,186C 'bql':131C,170C 'broadcom':19B,31B 'broadcom-hardwar':18B 'buffer':41B 'byte':112C,168C 'cat':250C 'cb':108C,110C,159C 'cc':223C 'clone':191C,233C,260C 'code':80B 'complet':124C,164C 'control':36B,103C,117C,185C 'copi':203C 'count':238C 'credit':55B,130C,166C 'cve':12A,15A 'data':83B 'dd':224C 'denial':70B 'denial-of-servic':69B 'describ':67B 'devic':215C 'driver':33B,197C 'dst':219C,229C 'earlier':50B,162C,202C 'echo':213C,218C,228C,232C,237C,241C,246C 'ee':225C 'embed':21B 'eth0':216C 'ether':132C 'ethernet':32B 'execut':81B 'ff':226C 'first':107C 'follow':90C 'free':126C 'get':54B 'hand':195C 'hardwar':20B 'idl':258C 'iff':135C 'inflight':252C 'infrastructur':22B 'kernel':2A,25B,88C 'last':109C,158C 'leav':134C,263C 'linux':1A,24B,87C 'linux-kernel':23B 'mac':220C 'may':43B 'mode':193C 'modprob':209C 'net':95C 'never':53B 'next':155C 'nonzero':254C 'overwrit':157C 'pg':211C 'pg/eth0':227C,231C,236C,240C 'pg/kpktgend_0':217C 'pg/pgctrl':243C,248C 'pi':28B 'pktgen':189C,210C 'queu':48B 'queue':8A,58B,173C,259C 'raspberri':27B 'raspberry-pi':26B 'read':120C 'reproduc':187C 'reset':11A,63B,177C 'resolv':94C 'resubmit':77B,144C 'ring':153C,208C 'sent':113C 'servic':72B 'set':139C 'setup':133C 'share':4A,46B,138C,146C 'skb':5A,99C,116C,128C,137C,147C,181C,192C,200C,234C,261C 'skbs':78B 'sleep':244C 'slot':52B,163C 'socket':40B 'sourc':66B 'stack':142C 'stall':6A,59B,74B,171C 'start':242C 'stay':253C 'still':44B,150C,205C 'stop':247C 'store':106C 'style':73B 'theft':84B 'transmit':7A,51B,156C 'trigger':75B 'tx':136C 'unshar':97C,179C 'vulner':91C 'wait':249C 'watchdog':10A,62B,176C 'without':165C 'write':34B,101C,183C 'zero':266C","nicknames":[],"mitigations":[],"who_affected":"Systems running Linux with the bcmgenet Ethernet driver, which is used on Broadcom Raspberry Pi and set-top box class hardware. The stall needs the stack to resubmit a shared skb while earlier copies are still in the ring, which the sources show with pktgen clone_skb mode. Hosts with other NICs or without bcmgenet can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:40+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99192","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99192","severity":null,"published_at":"2026-10-28T11:17:40+00:00","modified_at":"2026-10-28T11:17:40+00:00","first_seen_at":"2026-10-28T11:32:37+00:00","fetched_at":"2026-10-28T11:32:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}