All vulnerabilities
CVE-2026-98052

Linux: net: bcmasp: clear txcb->last before writing each descriptor

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
7.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.13%Chance of exploitation activity in the next 30 days, higher than 2% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1e213ba7cb3b9dd97ac2e0a1054e6d0d1d91f5bcAlso 9b26b54861ce05307d39a54ddedddf8747419614, 47a5cecca925ceb175d5adf712e667acf78f475f and 2 moreCVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 1e213ba7cb3b9dd97ac2e0a1054e6d0d1d91f5bcLinuxCVE List
  • 9b26b54861ce05307d39a54ddedddf8747419614LinuxCVE List
  • 47a5cecca925ceb175d5adf712e667acf78f475fLinuxCVE List
  • 17e6ad484dea5ddf1c4a3d6ec77a5929161234deLinuxCVE List
  • 18e5e0ec0e9282c897e2aa81a3e43ccaee03b003LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

net: bcmasp: clear txcb->last before writing each descriptor

bcmasp_xmit() only wrote txcb->last = true for the final fragment of an SKB; non-final fragments left the field untouched. If a descriptor slot was reused while it still held a stale true from a previous SKB (possible when tx_spb_ring_full() underreported fullness), bcmasp_tx_reclaim() would see last == true mid-SKB and call dev_consume_skb_any() prematurely, freeing the sk_buff while its remaining fragments were still in flight.

Unconditionally clear txcb->last before the conditional set so every descriptor slot starts from a known false state regardless of what a prior transmission left behind.

Text from CVE List

Affected versions 12

  • Linuxaffected: 490cb412007de593e07c1d3e2b1ec4233886707c before 1e213ba7cb3b9dd97ac2e0a1054e6d0d1d91f5bcCVE List
  • Linuxaffected: 490cb412007de593e07c1d3e2b1ec4233886707c before 9b26b54861ce05307d39a54ddedddf8747419614CVE List
  • Linuxaffected: 490cb412007de593e07c1d3e2b1ec4233886707c before 47a5cecca925ceb175d5adf712e667acf78f475fCVE List
  • Linuxaffected: 490cb412007de593e07c1d3e2b1ec4233886707c before 17e6ad484dea5ddf1c4a3d6ec77a5929161234deCVE List
  • Linuxaffected: 490cb412007de593e07c1d3e2b1ec4233886707c before 18e5e0ec0e9282c897e2aa81a3e43ccaee03b003CVE List
  • Linuxaffected: 6.6CVE List
  • Linuxunaffected: all versions before 6.6CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5