CVE-2026-98052: net: bcmasp: clear txcb->last before writing each descriptor
In the Linux kernel, the following vulnerability has been resolved:
net: bcmasp: clear txcb->last before writing each descriptor
bcmaspxmit() only wrote txcb->last = true for the final fragment of an SKB; non-final fragments left the field untouched. If a descriptor slot was reused while it still held a stale true from a previous SKB (possible when txspbringfull() underreported fullness), bcmasptxreclaim() would see last == true mid-SKB and call devconsumeskbany() prematurely, freeing the skbuff while its remaining fragments were still in flight.
Unconditionally clear txcb->last before the conditional set so every descriptor slot starts from a known false state regardless of what a prior transmission left behind.
Affected Software
Event History
Frequently Asked Questions
What condition is required for this issue to occur?
A descriptor slot must be reused with a stale true value in txcb->last from a prior SKB. This is possible when tx_spb_ring_full() underreports ring fullness, allowing a non-final fragment to retain that stale value.
What is the impact when the stale last flag is encountered?
The transmit reclaim path can treat a mid-SKB descriptor as the final fragment and call dev_consume_skb_any() too early. This frees the sk_buff while remaining fragments are still in flight.
What change addresses the issue?
The fix clears txcb->last before writing each descriptor, then sets it true only for the final SKB fragment. This ensures reused descriptor slots cannot retain a prior transmission's final-fragment state.