Linux Kernel EUVD-2026-86704

Exploitation requires that the target run the Linux bcmasp (Broadcom ASP 2.0) Ethernet driver - present only on specific Broadcom embedded/SoC hardware - and the attacker must already have local, low-privileged access (PR:L) to generate transmit traffic that exercises the tx_spb_ring_full() path. The faulty slot check is triggered under conditions where multiple consecutive descriptor slots are needed for a transmission. Limiting factors: no remote vector (AV:L), requires valid local credentials, requires the specific Broadcom network hardware/driver, and impact is confined to availability (C:N/I:N) with no confidentiality or integrity exposure.

All signals point to a low real-world priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) describes a locally exploitable, low-privilege availability-only flaw with no confidentiality or integrity impact. EPSS reinforces this: 0.17% probability at the 5th percentile indicates negligible expected exploitation. The CVE is NOT on CISA KEV and no POC is referenced, so there is no evidence of active or opportunistic exploitation. There is no SSVC decision data in the input. The signals are mutually consistent (low EPSS + no KEV + local-only + availability-only), so this is a high-CVSS-relative-to-impact but genuinely low-real-risk hardening fix rather than an urgent threat. One CONFLICT must be flagged: the input Tags list 'Information Disclosure', but the CVSS vector sets C:N and the description concerns a transmit (TX) descriptor-ring full-check logic error - there is no confidentiality impact, so the 'Information Disclosure' tag is inconsistent with the actual vulnerability and should be disregarded.

A local, low-privileged user on a system using the Broadcom ASP (bcmasp) Ethernet driver generates heavy network transmit load; because tx_spb_ring_full() incorrectly re-checked the same descriptor slot cnt times instead of advancing, the ring-full condition is misjudged and the driver may attempt to use slots that are not actually free, leading to transmit malfunction or a kernel-side denial of service on the network path. No public exploit code is identified at time of analysis, and exploitation is bounded to the specific Broadcom hardware/driver.