What is the CVSS score of CVE-2026-64125?

CVE-2026-64125 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Linux CVE-2026-64125

Q: Which versions of Linux are affected by CVE-2026-64125?

A critical denial-of-service vulnerability in the Linux kernel's Broadcom GENET Ethernet driver affects systems with Broadcom network interfaces, including Raspberry Pi 4B and certain edge computing…. A patch is available.

Q: How to fix or mitigate CVE-2026-64125?

Within 24 hours, identify and inventory all systems running Broadcom GENET Ethernet drivers (Raspberry Pi 4B, Broadcom 4908-family SoCs) in production environments and classify by business criticality. Within 7 days, deploy the available vendor patch to all identified systems; for critical systems pending patching, disable Energy-Efficient Ethernet (EEE) via ethtool (ethtool --set-eee [interface] eee off) as immediate mitigation. Within 30 days, verify patch deployment across all affected systems and document any systems with EEE disabled pending scheduled maintenance windows.

EUVD-2026-45810 CRITICAL

2026-07-19 Linux

GHSA-89rr-cfw2-c9px

Denial Of Service Linux Broadcom

Critical

Disputed · 9.8 Vendor: Linux

View

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 20, 2026

Denial-of-service and memory corruption in the Linux kernel's Broadcom GENET (bcmgenet) Ethernet driver occurs when RBUF_EEE_EN and RBUF_PM_EN are set in RBUF_ENERGY_CTRL and MAC Energy-Efficient Ethernet becomes active, silently halting the RX path while the link stays up and, on some boards, triggering a paging fault in skb_release_data via bcmgenet_rx_poll on an LPI exit. It affects Linux systems using Broadcom GENET NICs (e.g. Raspberry Pi 4B/BCM2711, Broadcom 4908-family SoCs), and is triggered by default now that phy_support_eee() enables EEE automatically, or on older kernels once TX LPI is enabled via ethtool. No public exploit identified at time of analysis; EPSS is low at 0.18% (8th percentile), and the CISA-KEV / attacker-controlled framing implied by the CVSS 9.8 does not match the local hardware-interaction nature of the bug.

Affected VersionsENISA

Linux patch: 6.18.34

Linux 6ef398ea60d931b97d69ed080bd0bd00fac38ec6 <9a1730245e416d11ad5c0f2c100061d61cc43f60

Linux 6ef398ea60d931b97d69ed080bd0bd00fac38ec6 <a212fc08f5c48a16a94092bf0a9a8b7cf4483b11

Linux patch: 7.1

Linux 6ef398ea60d931b97d69ed080bd0bd00fac38ec6 <b579f3a73da7a7e74213558f4cc3d865c30aaa78

Linux patch: 6.1.175

Linux patch: 6.12.92

Linux 6ef398ea60d931b97d69ed080bd0bd00fac38ec6 <289499907399c5a9f2ed82cb34df49112bb8488f

Linux 6ef398ea60d931b97d69ed080bd0bd00fac38ec6 <49bdf6bbb21b9c6e3f4d0c1910bf0ef98424be95

Linux 6ef398ea60d931b97d69ed080bd0bd00fac38ec6 <3d4ef05266ab16d8ef7dd21658a557801eb78704

Linux patch: 0

Linux 3.19

Linux patch: 6.6.142

Linux patch: 5.10.258

Linux 6ef398ea60d931b97d69ed080bd0bd00fac38ec6 <f2782ddac82c70df313012da5f71f1f06b5553ca

Linux 6ef398ea60d931b97d69ed080bd0bd00fac38ec6 <2040eb83f6ada148fb32dd98b943a498005d79f2

Linux patch: 7.0.11

Linux patch: 5.15.209

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when Broadcom gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)

Vendor (Linux) PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE CRITICAL

Red Hat 5.5 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Jul 20, 2026 - 15:22 NVD

9.8 (CRITICAL)

Patch available

Jul 19, 2026 - 17:03 EUVD

CVE Published

Jul 19, 2026 - 15:40 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 19, 2026 - 15:40 cve.org

CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: bcmgenet: keep RBUF EEE/PM disabled

Setting RBUF_EEE_EN | RBUF_PM_EN in RBUF_ENERGY_CTRL breaks the RX path on GENET hardware once MAC EEE becomes active. RX traffic stops flowing while the link stays up and the usual descriptor/RX error counters remain quiet. In that state the MAC still accepts frames (rbuf_ovflow_cnt keeps climbing) but RBUF no longer forwards them to DMA, so rx_packets is no longer incremented at the netdev level. On some boards the corruption ends up as a paging fault in skb_release_data via bcmgenet_rx_poll on an LPI exit.

Reproduced on Pi 4B (BCM2711 + BCM54213PE) and confirmed by Florian Fainelli on an internal Broadcom 4908-family board with the same crash signature. RBUF_PM_EN is not publicly documented.

This shows up more often now that phy_support_eee() enables EEE by default, but it also affects older kernels as soon as TX LPI is turned on via ethtool, so it is not specific to recent changes.

Always clear RBUF_EEE_EN | RBUF_PM_EN in bcmgenet_eee_enable_set so the bits stay off across resets. UMAC and TBUF setup is left alone so TX-side EEE keeps working.

Executive ViewAI

Why It Matters

A critical denial-of-service vulnerability in the Linux kernel's Broadcom GENET Ethernet driver affects systems with Broadcom network interfaces, including Raspberry Pi 4B and certain edge computing platforms. The vulnerability silently halts network reception while the link appears active, rendering affected devices unreachable. Although public exploits are not currently available and exploitation likelihood is low, the critical severity and potential memory corruption warrant immediate patching of affected infrastructure.

Recommended Action

Within 24 hours, identify and inventory all systems running Broadcom GENET Ethernet drivers (Raspberry Pi 4B, Broadcom 4908-family SoCs) in production environments and classify by business criticality. Within 7 days, deploy the available vendor patch to all identified systems; for critical systems pending patching, disable Energy-Efficient Ethernet (EEE) via ethtool (ethtool --set-eee [interface] eee off) as immediate mitigation. Within 30 days, verify patch deployment across all affected systems and document any systems with EEE disabled pending scheduled maintenance windows.

Business Impact: High

Compensating Controls

Disable Energy-Efficient Ethernet on affected Broadcom GENET interfaces using ethtool --set-eee [interface] eee off as interim mitigation until patches are applied. Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 92% exploitable

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +49

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Broadcom

View all

CVE-2021-40438 CRITICAL Act Now POC

9.0 Sep 16

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.4.4

CVE-2018-1273 CRITICAL Act Now POC

9.8 Apr 11

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property

CVE-2014-0160 HIGH Act Now POC

7.5 Apr 07

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

CVE-2022-2068 HIGH Act Now

7.3 Jun 21

In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehas

CVE-2016-8204 CRITICAL Emergency

9.8 Jan 14

A Directory Traversal vulnerability in FileReceiveServlet in the Brocade Network Advisor versions released prior to and

CVE-2016-0801 CRITICAL Emergency POC

9.8 Feb 07

The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01

CVE-2020-1967 HIGH Act Now POC

7.5 Apr 21

Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due

CVE-2017-0561 CRITICAL Act Now POC

9.8 Apr 07

A remote code execution vulnerability in the Broadcom Wi-Fi firmware could enable a remote attacker to execute arbitrary

CVE-2017-9417 CRITICAL Emergency POC

9.8 Jun 04

Broadcom BCM43xx Wi-Fi chips allow remote attackers to execute arbitrary code via unspecified vectors, aka the "Broadpwn

CVE-2026-22719 HIGH Act Now

8.1 Feb 25

VMware Aria Operations contains a command injection vulnerability (CVE-2026-22719, CVSS 8.1) that allows unauthenticated

CVE-2017-11120 CRITICAL Emergency POC

9.8 Sep 28

On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo

CVE-2012-2619 HIGH Act Now POC

7.8 Nov 14

The Broadcom BCM4325 and BCM4329 Wi-Fi chips, as used in certain Acer, Apple, Asus, Ford, HTC, Kyocera, LG, Malata, Moto

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Critical

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

References

Advisories & patches

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back