Linux kernel CVE-2026-98052

Requires the target system to use the Broadcom ASP 2.0 (bcmasp) Ethernet driver - specific Broadcom SoC hardware, not a general-purpose deployment. Exploitation further depends on the bcmasp TX path recycling a descriptor slot that still holds a stale 'last==true' flag from a prior SKB, which the description ties to tx_spb_ring_full() underreporting ring fullness under fragmented-transmit load. This is a state/timing-dependent condition rather than a directly crafted input, and requires local access to generate the TX traffic; there is no remote or unauthenticated path. The limiting factors - required hardware, local access, and the non-deterministic descriptor-reuse race - make reliable triggering difficult despite the high nominal CVSS.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) overstates real-world risk for what is fundamentally a transmit-path use-after-free (CWE-416, not the CWE:N/A shown) in a niche Broadcom embedded NIC driver. The description explicitly frames the impact as premature sk_buff freeing while fragments are still in flight - i.e. memory corruption leading to a kernel crash, not information disclosure. There are three key mismatches: (1) the 'Information Disclosure' tag contradicts the described UAF/crash behavior; (2) AC:L is too generous - the bug only manifests when a descriptor slot is reused while holding a stale 'last==true' AND tx_spb_ring_full() underreports fullness, a timing/state-dependent condition that is not directly attacker-controlled, so AC:H is more honest; and (3) C:H/I:H look aspirational - the primary observable effect is a crash (A:H), with at most limited integrity impact (I:L) from the corrupted TX ring. No EPSS score, no CISA KEV listing, and no public POC are present in the intelligence, and the reference set is entirely stable-tree git commits plus the NVD mirror - consistent with a routine kernel hardening fix rather than an actively exploited flaw. Net: this is a high-CVSS-but-low-real-risk item; realistic severity is around 5.0 (Medium).

A local user with the ability to drive network traffic on a Broadcom ASP 2.0 interface transmits fragmented (scatter-gather) SKBs in a pattern that causes TX descriptor slots to be recycled while a stale 'last' flag remains set. The TX reclaim path then frees an sk_buff mid-SKB while its remaining fragments are still queued, corrupting kernel memory and typically panicking the system. No public exploit code is identified at time of analysis, and reliable triggering depends on winning the descriptor-reuse race rather than a deterministic input.