SB2026102979 - Race condition in Linux kernel broadcom genet driver

Description

This security bulletin contains information about 1 vulnerability.

1) Race condition (CVE-ID: CVE-2026-99192)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by stalling a network transmit queue.

The vulnerability exists due to improper synchronization of shared socket buffer control-block updates in the Linux kernel bcmgenet driver when transmitting a buffer that is still pending completion in the transmit ring. A local privileged user can trigger repeated transmission of a shared buffer to overwrite its last_cb state, preventing earlier transmit slots from crediting their completed bytes and causing byte queue limits (BQL) to stall the queue until the watchdog resets it.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/40c04abcbc34e3afe338f41dae851ecbd72852ac
• https://git.kernel.org/stable/c/7939ad3b4db9eadf45a64f0524f38337a9494672
• https://git.kernel.org/stable/c/89771ce4f8f67dcffae561b2ccac95c0f6e3aa01