Skip to main content

Linux Kernel EUVDEUVD-2026-38955

| CVE-2026-53087 HIGH
Memory Leak (CWE-401)
2026-06-24 Linux GHSA-jgp5-77cc-cfg7
Information Disclosure Linux Red Hat Suse
7.5
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.7 MEDIUM

Leak triggers via the local TX reclaim path under specific queue/link conditions (AV:L, AC:H, PR:L); cumulative BD exhaustion eventually halts interface transmission (A:H); no confidentiality/integrity impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 09:07 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.5 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 24, 2026 - 16:30 cve.org
HIGH 7.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: bcmgenet: fix leaking free_bds

While reclaiming the tx queue we fast forward the write pointer to drop any data in flight. These dropped frames are not added back to the pool of free bds. We also need to tell the netdev that we are dropping said data.

AnalysisAI

Denial-of-service via resource leak in the Linux kernel's Broadcom GENET (bcmgenet) Ethernet driver allows the transmit buffer-descriptor (BD) pool to be slowly exhausted. When the driver reclaims a TX queue and fast-forwards the write pointer to drop in-flight frames, those dropped frames' buffer descriptors are never returned to the free_bds pool and the netdev is not told the frames were dropped, gradually starving the TX ring until the interface can no longer transmit. There is no public exploit identified at time of analysis, EPSS is low (0.16%, 6th percentile), and a vendor (stable-tree) patch is available; the impact is availability-only (CVSS A:H, C:N/I:N).

Technical ContextAI

The affected component is the bcmgenet driver, which supports Broadcom's GENET Gigabit Ethernet MAC found in many Broadcom SoCs (notably the Raspberry Pi 4/5 family and various set-top-box/embedded platforms). The driver manages a ring of buffer descriptors (BDs); free descriptors are tracked in a free_bds pool that throttles and gates TX. The bug lives in the TX reclaim path: when frames in flight are discarded by advancing the write pointer, the corresponding BDs are leaked rather than recycled, and the upper netdev TX accounting is not updated. The root cause class is a missing release of a reusable resource (akin to CWE-401/CWE-772 - leak of an internal resource), even though the input lists CWE as N/A. Over time the leak monotonically shrinks the usable descriptor pool.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.18.33, 7.0.10, or 7.1 (or apply the relevant backport for your branch), pulling the bcmgenet fix from the kernel stable tree commits listed at https://git.kernel.org/stable/c/150d06aae1839a6564ab200ef0e7291c3528bbb0 and its siblings; on distribution kernels, install the vendor's updated kernel package. There is no clean feature-level workaround because the leak is in the driver's core TX reclaim path; as compensating controls until patched, you can monitor the interface for rising TX stalls/dropped counters and periodically reset the interface (ip link set dev <iface> down/up) or reload the genet module to reset the BD pool - note this causes brief network outages and only resets, not prevents, the leak. On platforms where an alternate NIC is available, shifting traffic off the GENET interface avoids the path entirely at the cost of using different hardware.

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

EUVD-2026-38955 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy