{"id":"CVE-2026-98574","title":"net: bcmgenet: stop Tx NAPI before disabling the queues","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bcmgenet: stop Tx NAPI before disabling the queues\n\nbcmgenet_netif_stop() and the Wake-on-LAN branch of bcmgenet_suspend()\nboth disable the Tx queues first and sto…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 254f3239dd070e469f45c3ca8b6ac38e47d6c730 < 63bcc2fee6419963e45e7c2cd698fa862409601d","Linux >= 254f3239dd070e469f45c3ca8b6ac38e47d6c730 < f329d42423089904758f2685cda295de9bf99441","Linux >= 254f3239dd070e469f45c3ca8b6ac38e47d6c730 < 7e87508b5c4d81210d0a736ed01962e52f5c4c56","Linux 6.15"],"published":"2026-10-18","updated":"2026-10-18","sourceUpdated":"2026-10-18T15:18:39.767Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98574","references":[{"url":"https://git.kernel.org/stable/c/63bcc2fee6419963e45e7c2cd698fa862409601d"},{"url":"https://git.kernel.org/stable/c/f329d42423089904758f2685cda295de9bf99441"},{"url":"https://git.kernel.org/stable/c/7e87508b5c4d81210d0a736ed01962e52f5c4c56"}],"tags":["cve.org"],"ingestedAt":"2026-10-18T15:45:12.256Z","slug":"CVE-2026-98574","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: bcmgenet: stop Tx NAPI before disabling the queues\n\nbcmgenet_netif_stop() and the Wake-on-LAN branch of bcmgenet_suspend()\nboth disable the Tx queues first and stop Tx NAPI several steps later. A\ncompletion in flight calls netif_tx_wake_queue() in between, and nothing\nstops the queue again, so a transmit can reach the rings after they have\nbeen freed.\n\nClose is safe because dev_deactivate_many() stops the qdisc first.\nbcmgenet_suspend() does not, so stop Tx NAPI before the queues on both\npaths.\n\nKASAN on a Raspberry Pi CM4, driven from an MTU change because suspend\nfreezes user space before the callback runs:\n\n  BUG: KASAN: use-after-free in bcmgenet_xmit+0x17f8/0x2258\n  Write of size 8 at addr ffffff8055844a68 by task ksoftirqd/0/14\n   bcmgenet_xmit+0x17f8/0x2258\n   dev_hard_start_xmit+0x13c/0x588\n   sch_direct_xmit+0x108/0x340\n   __dev_queue_xmit+0x1190/0x3848\n\n## Affected\n\n- `Linux >= 254f3239dd070e469f45c3ca8b6ac38e47d6c730 < 63bcc2fee6419963e45e7c2cd698fa862409601d`\n- `Linux >= 254f3239dd070e469f45c3ca8b6ac38e47d6c730 < f329d42423089904758f2685cda295de9bf99441`\n- `Linux >= 254f3239dd070e469f45c3ca8b6ac38e47d6c730 < 7e87508b5c4d81210d0a736ed01962e52f5c4c56`\n- `Linux 6.15`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}