CVE-2026-98051: net: bcmasp: fix tx_spb_ring_full() checking same slot cnt times
In the Linux kernel, the following vulnerability has been resolved:
net: bcmasp: fix txspbringfull() checking same slot cnt times
The loop initialised nextindex from intf->txspbindex on every iteration, so incrring() always produced the same result and only one slot was ever tested. Move the initialisation before the loop so each iteration advances nextindex and the function correctly checks that cnt consecutive descriptor slots are available before allowing a new transmission.
Affected Software
Event History
Frequently Asked Questions
What is the practical impact of the faulty availability check?
The transmit path could allow a new transmission after checking only one descriptor slot, even when multiple consecutive slots were required. This can cause the driver to proceed without verifying that all required descriptor slots are available.
What component is affected?
The issue is in the Linux kernel bcmasp network driver, specifically its transmit SPB ring availability check.
How can I determine whether my kernel contains the fix?
Check whether your kernel source or applied stable patches includes any of the referenced commits: f7f7a16dd46ace4e221336a184c7806f7de19547, a8bddab54aa68b407f12294acb05bd552fb6a492, or 5df7ecd302488287665ab9767bacba7ed7e2842f.