CVE-2026-98052 PUBLISHED

net: bcmasp: clear txcb->last before writing each descriptor

Assigner: Linux
Reserved: 25.09.2026 Published: 25.09.2026 Updated: 25.09.2026

In the Linux kernel, the following vulnerability has been resolved:

net: bcmasp: clear txcb->last before writing each descriptor

bcmasp_xmit() only wrote txcb->last = true for the final fragment of an SKB; non-final fragments left the field untouched. If a descriptor slot was reused while it still held a stale true from a previous SKB (possible when tx_spb_ring_full() underreported fullness), bcmasp_tx_reclaim() would see last == true mid-SKB and call dev_consume_skb_any() prematurely, freeing the sk_buff while its remaining fragments were still in flight.

Unconditionally clear txcb->last before the conditional set so every descriptor slot starts from a known false state regardless of what a prior transmission left behind.

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 7.8

AV:L - The bug is in bcmasp_xmit() TX ring bookkeeping, reached via sendmsg/sendfile -> dev_queue_xmit -> bcmasp_xmit; no malformed input exists and the trigger is TX ring pressure from multi-fragment (NETIF_F_SG) SKBs, which a local user produces by flooding sockets through the bcmasp interface. AC:L - The attacker controls the traffic load: flooding multi-frag SKBs makes buggy tx_spb_ring_full() let bcmasp_xmit overwrite unreclaimed slots, so non-final fragments repeatedly land in slots holding a stale txcb->last=true; no hardware state outside the attacker's control is needed. PR:L - Sending TCP/UDP traffic that egresses the bcmasp netdev needs only an ordinary unprivileged local account; there is no capability check anywhere on the transmit path. UI:N - No victim action is involved; the attacker generates the transmit traffic entirely by themselves. S:U - The corruption affects kernel sk_buff/page memory in the same kernel that runs the driver; no VM or IOMMU boundary is crossed. C:H - bcmasp_tx_reclaim() frees the skb (dev_consume_skb_any) while its later fragments are still mapped for DMA, so freed and reallocated pages can be transmitted on the wire and the stale skb is accessed again: a use-after-free with disclosure potential. I:H - When the real final fragment is reclaimed later, dev_consume_skb_any() is called a second time on the same skb, a double free/UAF of sk_buff and frag pages that could be groomed into slab corruption. A:H - Double freeing the sk_buff and touching freed memory in bcmasp_tx_reclaim() from TX NAPI causes slab corruption and kernel oops/panic on the host.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from 490cb412007de593e07c1d3e2b1ec4233886707c to 9b26b54861ce05307d39a54ddedddf8747419614 (excl.)
  • affected from 490cb412007de593e07c1d3e2b1ec4233886707c to 47a5cecca925ceb175d5adf712e667acf78f475f (excl.)
  • affected from 490cb412007de593e07c1d3e2b1ec4233886707c to 17e6ad484dea5ddf1c4a3d6ec77a5929161234de (excl.)
  • affected from 490cb412007de593e07c1d3e2b1ec4233886707c to 18e5e0ec0e9282c897e2aa81a3e43ccaee03b003 (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 6.6 is affected
  • unaffected from 0 to 6.6 (excl.)
  • unaffected from 6.12.111 to 6.12.* (incl.)
  • unaffected from 6.18.53 to 6.18.* (incl.)
  • unaffected from 7.2.7 to 7.2.* (incl.)
  • unaffected from 7.3-rc3 to * (incl.)

References