EUVD-2026-38955
GHSA-jgp5-77cc-cfg7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Leak triggers via the local TX reclaim path under specific queue/link conditions (AV:L, AC:H, PR:L); cumulative BD exhaustion eventually halts interface transmission (A:H); no confidentiality/integrity impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
net: bcmgenet: fix leaking free_bds
While reclaiming the tx queue we fast forward the write pointer to drop any data in flight. These dropped frames are not added back to the pool of free bds. We also need to tell the netdev that we are dropping said data.
AnalysisAI
Denial-of-service via resource leak in the Linux kernel's Broadcom GENET (bcmgenet) Ethernet driver allows the transmit buffer-descriptor (BD) pool to be slowly exhausted. When the driver reclaims a TX queue and fast-forwards the write pointer to drop in-flight frames, those dropped frames' buffer descriptors are never returned to the free_bds pool and the netdev is not told the frames were dropped, gradually starving the TX ring until the interface can no longer transmit. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the target to be running the Linux bcmgenet driver on Broadcom GENET Ethernet hardware (e.g., Raspberry Pi 4/5, Broadcom SoCs) - non-GENET NICs are unaffected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mixed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker (or adverse network conditions) repeatedly induces TX queue reclaim with frames in flight - for example by driving link flaps or congestion that trigger TX drops on a Broadcom GENET interface (e.g., a Raspberry Pi acting as a gateway). Each reclaim leaks buffer descriptors, and over many cycles the free_bds pool is exhausted until the interface stops transmitting, denying network service. … |
| Remediation | Vendor-released patch: update to a fixed stable kernel - 6.18.33, 7.0.10, or 7.1 (or apply the relevant backport for your branch), pulling the bcmgenet fix from the kernel stable tree commits listed at https://git.kernel.org/stable/c/150d06aae1839a6564ab200ef0e7291c3528bbb0 and its siblings; on distribution kernels, install the vendor's updated kernel package. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify and inventory all systems using Broadcom GENET Ethernet hardware. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today