UBUNTU-CVE-2026-98574: Use After Free
In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: stop Tx NAPI before disabling the queues bcmgenetnetifstop() and the Wake-on-LAN branch of bcmgenetsuspend() both disable the Tx queues first and stop Tx NAPI several steps later. A completion in flight calls netiftxwakequeue() in between, and nothing stops the queue again, so a transmit can reach the rings after they have been freed. Close is safe because devdeactivatemany() stops the qdisc first. bcmgenetsuspend() does not, so stop Tx NAPI before the queues on both paths. KASAN on a Raspberry Pi CM4, driven from an MTU change because suspend freezes user space before the callback runs: BUG: KASAN: use-after-free in bcmgenetxmit+0x17f8/0x2258 Write of size 8 at addr ffffff8055844a68 by task ksoftirqd/0/14 bcmgenetxmit+0x17f8/0x2258 devhardstartxmit+0x13c/0x588 schdirectxmit+0x108/0x340 devqueuexmit+0x1190/0x3848
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Update bcmgenet_netif_stop() and the Wake-on-LAN branch of bcmgenet_suspend() so Tx NAPI is stopped before the Tx queues are disabled.
Linux kernel net: bcmgenet Tx NAPI and Tx queue shutdown order = Stop Tx NAPI before disabling Tx queues
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The affected Ubuntu kernel package families listed are linux-riscv, linux-realtime, linux-hwe-edge, linux-azure, linux-gcp, linux-azure-fde, linux-gke, and linux-aws-5.0. The issue is in the bcmgenet network driver, so exposure depends on use of hardware supported by that driver.
When can the use-after-free occur?
The race can occur when a transmit completion wakes a Tx queue after the queues have been disabled but before Tx NAPI has been stopped. The described unsafe path is suspend, including its Wake-on-LAN branch; an in-flight transmission can then reach rings after they were freed.
Is normal interface shutdown affected in the same way?
The description states that close is safe because dev_deactivate_many() stops the qdisc first. The problematic ordering is specifically identified in bcmgenet_netif_stop() and the Wake-on-LAN path of bcmgenet_suspend().
What is the practical impact of successful triggering?
A transmit operation can access freed transmit-ring memory, resulting in a kernel use-after-free. The reported KASAN trace shows an 8-byte write in bcmgenet_xmit from the ksoftirqd context.