CVE-2026-53086 Overview
CVE-2026-53086 is a race condition vulnerability in the Linux kernel's Broadcom GENET (bcmgenet) Ethernet driver. The bcmgenet_timeout handler attempts to take down all transmit (TX) queues when a single queue times out. This overly broad reset behavior introduces race conditions with other TX queues that are still actively processing packets. The upstream fix restricts the handler to restarting only the timed-out queue, eliminating the racing condition. The issue affects Linux systems using Broadcom GENET Ethernet controllers, commonly found in Raspberry Pi and other Broadcom-based platforms.
Critical Impact
Concurrent manipulation of active TX queues by the timeout handler can lead to network instability, dropped packets, or kernel state corruption on affected Linux systems.
Affected Products
- Linux kernel versions containing the bcmgenet driver prior to the patched commits
- Systems using Broadcom GENET Gigabit Ethernet controllers
- Embedded and SBC platforms (e.g., Raspberry Pi 4/5) relying on the affected driver
Discovery Timeline
- 2026-06-24 - CVE-2026-53086 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-53086
Vulnerability Analysis
The vulnerability resides in the bcmgenet_timeout function within the Broadcom GENET Ethernet driver (drivers/net/ethernet/broadcom/genet/bcmgenet.c). When a single TX queue stalls and triggers the watchdog timeout, the handler indiscriminately disables and re-initializes all TX queues on the interface. This wide-scope reset overlaps with normal queue activity on unaffected queues, producing a classic race condition between the timeout recovery path and concurrent transmit operations.
The EPSS score for this issue is 0.161% (5.574 percentile), reflecting low expected exploitation activity. Because the vulnerability is a local kernel-state issue rather than a remotely triggered memory corruption, its primary impact is reliability and stability of networking under load.
Root Cause
The root cause is improper synchronization scope in the timeout recovery path. The handler treats a per-queue stall as an interface-wide failure and tears down queues that are still operational. Concurrent producers and consumers on those still-active queues collide with the reset logic, leading to inconsistent driver state.
Attack Vector
This flaw is not a remotely exploitable code execution issue. The race triggers under conditions where a single TX queue legitimately times out — for example, under heavy network load, packet flooding, or hardware-induced stalls. An adversary on the local network capable of saturating a queue could potentially induce the timeout and amplify network disruption, but no privilege escalation or memory corruption primitive is documented in the upstream fix description.
The vulnerability mechanism is described in the kernel commit messages. See the Kernel Git Commit 5393b2b5 and related backports for technical details.
Detection Methods for CVE-2026-53086
Indicators of Compromise
- Kernel log entries from bcmgenet indicating TX timeout events followed by queue resets across multiple queues
- Unexpected NETDEV WATCHDOG messages referencing the bcmgenet interface
- Intermittent packet loss or interface stalls correlated with high TX load
Detection Strategies
- Inventory Linux hosts running kernels with the unpatched bcmgenet driver using package management telemetry
- Correlate dmesg and journald logs for repeated bcmgenet_timeout invocations
- Monitor SNMP or ethtool counters for abnormal TX queue resets and drops
Monitoring Recommendations
- Forward kernel ring buffer events to a centralized log platform for trend analysis
- Alert on repeated NETDEV watchdog timeouts on the same interface within a short window
- Track network interface error counters as part of host health baselines
How to Mitigate CVE-2026-53086
Immediate Actions Required
- Identify affected hosts running the bcmgenet driver and prioritize them for kernel updates
- Apply the stable kernel updates containing the upstream fix from your Linux distribution
- Reduce sustained TX queue saturation where feasible until patches are deployed
Patch Information
The fix limits the bcmgenet_timeout handler to restarting only the queue that timed out. It is available in multiple stable branches via the following commits: Kernel Git Commit 5393b2b5, Kernel Git Commit 681fdfe8, Kernel Git Commit 7ce1c26a, Kernel Git Commit c270e2be, Kernel Git Commit e8206538, and Kernel Git Commit e85b0c0a.
Workarounds
- No supported workaround replaces patching; throttling traffic to avoid sustained TX saturation may reduce trigger frequency
- Where possible, distribute load across multiple TX queues or interfaces to limit single-queue stalls
- Monitor kernel watchdog logs and proactively reset interfaces during maintenance windows on unpatched systems
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
