CVE-2026-98798: net: bcmgenet: fix NULL dereference in set_coalesce before first open
In the Linux kernel, the following vulnerability has been resolved:
net: bcmgenet: fix NULL dereference in setcoalesce before first open
The Rx ring priv and index are only set in bcmgenetinitrxring(), which runs at open. Setting the Rx coalescing parameters on an interface that was never opened, e.g. "ethtool -C eth0 rx-usecs 50", dereferences a NULL ring->priv. The oops happens with RTNL held, so networking stays stuck until a reboot:
Unable to handle kernel paging request at virtual address 0000000000002788 pc : bcmgenetsetrxcoalesce.isra.0+0x10/0x88 lr : bcmgenetsetcoalesce+0xe8/0x180 Call trace: bcmgenetsetrxcoalesce.isra.0+0x10/0x88 (P) ethnlsetcoalesce.isra.0+0x490/0x570 ethnlsetcoalesce+0x48/0xc0 ethnldefaultsetdoit+0xf4/0x230 genlfamilyrcvmsgdoit+0xe8/0x160 genlrcvmsg+0x220/0x2a0 netlinkrcvskb+0x68/0x140 genlrcv+0x40/0x60 netlinkunicast+0x338/0x3c0 netlinksendmsg+0x19c/0x3f8 socksendmsg+0x64/0xc0 syssendto+0x124/0x198 arm64syssendto+0x30/0x48
Set priv and index at probe. Writing the registers while the interface is down is harmless because open resets the MAC and bcmgenetinitrxcoalesce() reapplies the stored values.
It was observed on a Raspberry Pi CM4, but should apply to all other genet devices.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
azurelinux/kernelto a version that resolves this vulnerability.Fixed in 6.6.161.1-1 - Compensating control
In the bcmgenet driver, initialize the Rx ring's priv and index fields at probe rather than only in bcmgenet_init_rx_ring() during interface open, preventing NULL dereferences when setting Rx coalescing before the first open.
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems using the Linux kernel bcmgenet network driver are exposed when an interface backed by that driver has never been opened and its receive coalescing settings are changed.
What action triggers the failure?
Changing Rx coalescing parameters before the interface is first opened triggers a NULL dereference. An example is running "ethtool -C eth0 rx-usecs 50" on an interface that has never been brought up.
What is the operational impact if exploitation succeeds?
The kernel oops occurs while RTNL is held, leaving networking stuck until the system is rebooted.
Is it safe to configure receive coalescing while the interface is down after applying the fix?
Yes. The fix initializes the ring private data and index at probe time; register writes while the interface is down are harmless because opening the interface resets the MAC and reapplies the stored coalescing values.