All vulnerabilities
CVE-2026-98051

Linux: net: bcmasp: fix tx_spb_ring_full() checking same slot cnt times

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.12%Chance of exploitation activity in the next 30 days, higher than 1% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in990df1ba4d0805d1e7f6148c364febd2ab618766Also 5df7ecd302488287665ab9767bacba7ed7e2842f, 0c5cf62e72d7a666ee4da757e122dc1600df1eccCVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 990df1ba4d0805d1e7f6148c364febd2ab618766LinuxCVE List
  • 5df7ecd302488287665ab9767bacba7ed7e2842fLinuxCVE List
  • 0c5cf62e72d7a666ee4da757e122dc1600df1eccLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

net: bcmasp: fix tx_spb_ring_full() checking same slot cnt times

The loop initialised next_index from intf->tx_spb_index on every iteration, so incr_ring() always produced the same result and only one slot was ever tested. Move the initialisation before the loop so each iteration advances next_index and the function correctly checks that cnt consecutive descriptor slots are available before allowing a new transmission.

Text from CVE List

Affected versions 12

  • Linuxaffected: 490cb412007de593e07c1d3e2b1ec4233886707c before 990df1ba4d0805d1e7f6148c364febd2ab618766CVE List
  • Linuxaffected: 490cb412007de593e07c1d3e2b1ec4233886707c before f7f7a16dd46ace4e221336a184c7806f7de19547CVE List
  • Linuxaffected: 490cb412007de593e07c1d3e2b1ec4233886707c before a8bddab54aa68b407f12294acb05bd552fb6a492CVE List
  • Linuxaffected: 490cb412007de593e07c1d3e2b1ec4233886707c before 5df7ecd302488287665ab9767bacba7ed7e2842fCVE List
  • Linuxaffected: 490cb412007de593e07c1d3e2b1ec4233886707c before 0c5cf62e72d7a666ee4da757e122dc1600df1eccCVE List
  • Linuxaffected: 6.6CVE List
  • Linuxunaffected: all versions before 6.6CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5