Race condition in Linux kernel - CVE-2026-99192

Vulnerability details

The vulnerability allows a local privileged user to cause a denial of service by stalling a network transmit queue.

The vulnerability exists due to improper synchronization of shared socket buffer control-block updates in the Linux kernel bcmgenet driver when transmitting a buffer that is still pending completion in the transmit ring. A local privileged user can trigger repeated transmission of a shared buffer to overwrite its last_cb state, preventing earlier transmit slots from crediting their completed bytes and causing byte queue limits (BQL) to stall the queue until the watchdog resets it.

Affected software

How to mitigate CVE-2026-99192

External References

• https://git.kernel.org/stable/c/40c04abcbc34e3afe338f41dae851ecbd72852ac
• https://git.kernel.org/stable/c/7939ad3b4db9eadf45a64f0524f38337a9494672
• https://git.kernel.org/stable/c/89771ce4f8f67dcffae561b2ccac95c0f6e3aa01

Related Security Bulletins

• Race condition in Linux kernel broadcom genet driver
• Debian update for linux