CVE-2026-53086 (GCVE-0-2026-53086)

Vulnerability from cvelistv5 – Published: 2026-06-24 16:30 – Updated: 2026-08-05 12:33
VLAI
Title
net: bcmgenet: fix racing timeout handler
Summary
In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix racing timeout handler The bcmgenet_timeout handler tries to take down all tx queues when a single queue times out. This is over zealous and causes many race conditions with queues that are still chugging along. Instead lets only restart the timed out queue.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 13ea657806cf73b379a0109f7042182f47c351a7 , < e85b0c0a12e967930044608311471b665baa315c (git)
Affected: 13ea657806cf73b379a0109f7042182f47c351a7 , < e8206538cbaf4f4068e99a4cb1138690a1e00499 (git)
Affected: 13ea657806cf73b379a0109f7042182f47c351a7 , < 681fdfe823b4f1036ed50b58b8838c7917ea389c (git)
Affected: 13ea657806cf73b379a0109f7042182f47c351a7 , < c270e2bec3e55a716d25c35341091339457ac883 (git)
Affected: 13ea657806cf73b379a0109f7042182f47c351a7 , < 7ce1c26aac3b318886a57425f64b522da7389153 (git)
Affected: 13ea657806cf73b379a0109f7042182f47c351a7 , < 5393b2b5bee2ac51a0043dc7f4ac3475f053d08d (git)
Create a notification for this product.
Linux Linux Affected: 4.2
Unaffected: 0 , < 4.2 (semver)
Unaffected: 6.1.175 , ≤ 6.1.* (semver)
Unaffected: 6.6.141 , ≤ 6.6.* (semver)
Unaffected: 6.12.91 , ≤ 6.12.* (semver)
Unaffected: 6.18.33 , ≤ 6.18.* (semver)
Unaffected: 7.0.10 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/broadcom/genet/bcmgenet.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e85b0c0a12e967930044608311471b665baa315c",
              "status": "affected",
              "version": "13ea657806cf73b379a0109f7042182f47c351a7",
              "versionType": "git"
            },
            {
              "lessThan": "e8206538cbaf4f4068e99a4cb1138690a1e00499",
              "status": "affected",
              "version": "13ea657806cf73b379a0109f7042182f47c351a7",
              "versionType": "git"
            },
            {
              "lessThan": "681fdfe823b4f1036ed50b58b8838c7917ea389c",
              "status": "affected",
              "version": "13ea657806cf73b379a0109f7042182f47c351a7",
              "versionType": "git"
            },
            {
              "lessThan": "c270e2bec3e55a716d25c35341091339457ac883",
              "status": "affected",
              "version": "13ea657806cf73b379a0109f7042182f47c351a7",
              "versionType": "git"
            },
            {
              "lessThan": "7ce1c26aac3b318886a57425f64b522da7389153",
              "status": "affected",
              "version": "13ea657806cf73b379a0109f7042182f47c351a7",
              "versionType": "git"
            },
            {
              "lessThan": "5393b2b5bee2ac51a0043dc7f4ac3475f053d08d",
              "status": "affected",
              "version": "13ea657806cf73b379a0109f7042182f47c351a7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/broadcom/genet/bcmgenet.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.2"
            },
            {
              "lessThan": "4.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.141",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.141",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.91",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.33",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bcmgenet: fix racing timeout handler\n\nThe bcmgenet_timeout handler tries to take down all tx queues when\na single queue times out. This is over zealous and causes many race\nconditions with queues that are still chugging along. Instead lets\nonly restart the timed out queue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable path is the Ethernet TX path and `ndo_tx_timeout` recovery for a network interface; a remote peer can cause the affected host or router to transmit traffic through bcmgenet without local code execution. In an internet-facing or routed embedded deployment, this is reachable via network traffic.\nAC:L - The race is between timeout recovery on one TX queue and other active TX queues, and an attacker can plausibly create sustained concurrent traffic to exercise multiple queues and keep the race repeatable. No special memory layout or victim interaction is required beyond traffic-induced queue activity.\nPR:N - No kernel privilege check gates the watchdog timeout handler once the interface is up. A remote unauthenticated peer can trigger outbound responses or forwarded traffic in a reasonable deployment.\nUI:N - Exploitation does not require a user to open a file, mount anything, or take an interactive action. The vulnerable recovery runs asynchronously from normal network transmission and watchdog handling.\nS:U - The impact remains within the same host kernel and network device security authority. This is not a VM escape, IOMMU boundary bypass, or cross-scope sandbox escape.\nC:H - The old handler reclaimed and freed in-flight SKBs/descriptors for queues that could still be transmitting, creating a DMA/use-after-free condition. Freed or reused kernel memory could plausibly be transmitted or otherwise exposed, so confidentiality is high.\nI:H - Freeing and reusing active TX control blocks while hardware still owns them is UAF-style memory corruption of kernel driver/DMA state. Under the required conservative scoring, this is treated as potentially enabling high-integrity impact rather than mere packet loss.\nA:H - The race can corrupt TX ring accounting/state, trigger repeated TX watchdog failures, DMA/IOMMU faults, hangs, or kernel crashes. This is a high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:33:14.446Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e85b0c0a12e967930044608311471b665baa315c"
        },
        {
          "url": "https://git.kernel.org/stable/c/e8206538cbaf4f4068e99a4cb1138690a1e00499"
        },
        {
          "url": "https://git.kernel.org/stable/c/681fdfe823b4f1036ed50b58b8838c7917ea389c"
        },
        {
          "url": "https://git.kernel.org/stable/c/c270e2bec3e55a716d25c35341091339457ac883"
        },
        {
          "url": "https://git.kernel.org/stable/c/7ce1c26aac3b318886a57425f64b522da7389153"
        },
        {
          "url": "https://git.kernel.org/stable/c/5393b2b5bee2ac51a0043dc7f4ac3475f053d08d"
        }
      ],
      "title": "net: bcmgenet: fix racing timeout handler",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53086",
    "datePublished": "2026-06-24T16:30:26.111Z",
    "dateReserved": "2026-06-09T07:44:35.384Z",
    "dateUpdated": "2026-08-05T12:33:14.446Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-53086",
      "date": "2026-08-06",
      "epss": "0.00304",
      "percentile": "0.22693"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-09T14:38:48.000Z",
      "cve": "CVE-2026-53086",
      "id": "msrc_CVE-2026-53086",
      "initial_release_date": "2026-06-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net: bcmgenet: fix racing timeout handler",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-53086.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-53086\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-06-24T17:17:22.777\",\"lastModified\":\"2026-07-23T18:35:39.683\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: bcmgenet: fix racing timeout handler\\n\\nThe bcmgenet_timeout handler tries to take down all tx queues when\\na single queue times out. This is over zealous and causes many race\\nconditions with queues that are still chugging along. Instead lets\\nonly restart the timed out queue.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/broadcom/genet/bcmgenet.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"13ea657806cf73b379a0109f7042182f47c351a7\",\"lessThan\":\"e85b0c0a12e967930044608311471b665baa315c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"13ea657806cf73b379a0109f7042182f47c351a7\",\"lessThan\":\"e8206538cbaf4f4068e99a4cb1138690a1e00499\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"13ea657806cf73b379a0109f7042182f47c351a7\",\"lessThan\":\"681fdfe823b4f1036ed50b58b8838c7917ea389c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"13ea657806cf73b379a0109f7042182f47c351a7\",\"lessThan\":\"c270e2bec3e55a716d25c35341091339457ac883\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"13ea657806cf73b379a0109f7042182f47c351a7\",\"lessThan\":\"7ce1c26aac3b318886a57425f64b522da7389153\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"13ea657806cf73b379a0109f7042182f47c351a7\",\"lessThan\":\"5393b2b5bee2ac51a0043dc7f4ac3475f053d08d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/broadcom/genet/bcmgenet.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.175\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.141\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.91\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.33\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.10\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.2\",\"versionEndExcluding\":\"6.1.175\",\"matchCriteriaId\":\"7B785B39-3346-4CF2-89F5-2AC74C39A12C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.141\",\"matchCriteriaId\":\"97A9FFFA-22BB-4D5C-9790-5A2286E392F7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.91\",\"matchCriteriaId\":\"C918746B-DE6F-448F-A93E-A04C5481688D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.33\",\"matchCriteriaId\":\"96D99E49-380D-43AB-BDBA-25C3AD018A9C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.0.10\",\"matchCriteriaId\":\"A13475D2-59BF-4716-94B5-7C1D239A2CF4\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5393b2b5bee2ac51a0043dc7f4ac3475f053d08d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/681fdfe823b4f1036ed50b58b8838c7917ea389c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7ce1c26aac3b318886a57425f64b522da7389153\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c270e2bec3e55a716d25c35341091339457ac883\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e8206538cbaf4f4068e99a4cb1138690a1e00499\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e85b0c0a12e967930044608311471b665baa315c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T14:36:05+00:00",
      "cve": "CVE-2026-53086",
      "id": "CVE-2026-53086",
      "initial_release_date": "2026-06-24T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: bcmgenet: fix racing timeout handler",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53086.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-28T17:13:09Z",
      "cve": "CVE-2026-53086",
      "id": "CVE-2026-53086",
      "initial_release_date": "2026-06-30T01:43:50Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "618",
      "product_status:known_not_affected": "4",
      "product_status:recommended": "265",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-53086",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-53086.json",
      "version": "9"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.