CVE-2026-53087: Linux Kernel Privilege Escalation Flaw

CVE-2026-53087 Overview

CVE-2026-53087 is a Linux kernel vulnerability in the Broadcom GENET (bcmgenet) Ethernet driver. The flaw resides in the transmit queue reclaim path, where the driver fast-forwards the write pointer to drop in-flight data without returning the associated buffer descriptors (BDs) to the free pool. The netdev statistics are also not updated to reflect dropped frames. Over time, this resource accounting error depletes available transmit buffer descriptors and can degrade network functionality on affected systems, including Raspberry Pi devices and other Broadcom SoC platforms that rely on the GENET driver.

Critical Impact
Repeated TX queue reclaim operations leak free buffer descriptors, leading to resource exhaustion in the bcmgenet driver and potential network interface disruption.

Affected Products

Linux kernel versions containing the bcmgenet driver prior to the fixes in commits 150d06a, 25ff3a3, 3c3abbc, 3f3168a, 52b9f80, and ac4a29c
Broadcom GENET-based Ethernet hardware (commonly found in Broadcom SoCs and Raspberry Pi platforms)
Linux distributions shipping vulnerable kernel versions across multiple stable branches

Discovery Timeline

2026-06-24 - CVE-2026-53087 published to the National Vulnerability Database (NVD)
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53087

Vulnerability Analysis

The vulnerability is a [CWE-401] style resource leak in the bcmgenet network driver. During transmit queue reclaim, the driver advances the write pointer to discard frames that are still in flight. The associated transmit buffer descriptors that back those dropped frames are never returned to the driver's free BD pool. Each reclaim cycle that triggers this path reduces the pool of usable descriptors.

In addition to the descriptor accounting bug, the driver fails to inform the network device layer that frames were dropped. The netdev TX drop counters remain stale, hiding the loss from administrators and monitoring tools.

The practical consequence is a slow exhaustion of TX resources on the interface. Workloads that frequently trigger queue reclaim can reach a state where new packets cannot be enqueued, producing throughput degradation or full denial of service on the affected interface.

Root Cause

The root cause is incomplete cleanup logic in the TX reclaim routine of drivers/net/ethernet/broadcom/genet/bcmgenet.c. The fix path that advances the write pointer to drop pending frames omits two required steps: returning the dropped descriptors to free_bds, and incrementing the corresponding ndev->stats.tx_dropped counter.

Attack Vector

The trigger requires conditions that cause the driver to reclaim the TX queue with frames still in flight, such as link state transitions, interface resets, or error recovery paths. An adversary with the ability to induce these conditions, or workloads that legitimately exercise them, can repeatedly leak descriptors. The vulnerability does not provide code execution or privilege escalation. The impact is limited to availability of the affected network interface.

No public proof-of-concept has been published. The EPSS score is 0.161%, indicating low predicted exploitation activity.

A prose description of the fix is appropriate here because no verified exploit code exists. The patch restores both the descriptor accounting and the netdev drop statistics in the reclaim path. See the upstream commits referenced below for the exact code changes.

Detection Methods for CVE-2026-53087

Indicators of Compromise

Steady decline in available transmit buffer descriptors reported by the bcmgenet driver over time
Network interface throughput degradation or hangs on Broadcom GENET hardware without corresponding tx_dropped counter increases in ip -s link or ethtool -S output
Kernel logs showing repeated TX queue reclaim events on bcmgenet interfaces preceding interface unresponsiveness

Detection Strategies

Inventory Linux hosts running Broadcom GENET hardware and verify kernel version against the fixed commits 150d06a, 25ff3a3, 3c3abbc, 3f3168a, 52b9f80, and ac4a29c
Correlate interface availability metrics with kernel ring buffer messages from the bcmgenet module to identify hosts exhibiting the leak pattern
Track ethtool -S <iface> output over time and alert on monotonic decreases in free TX descriptors that do not recover after traffic subsides

Monitoring Recommendations

Forward dmesg and journalctl -k output to a centralized logging platform and create alerts for bcmgenet TX reclaim and TX timeout messages
Monitor per-interface drop counters and queue depth metrics through node-level exporters, comparing observed drops against application-layer retransmits
Track kernel package versions across the fleet to confirm patched builds are deployed on all GENET-equipped systems

How to Mitigate CVE-2026-53087

Immediate Actions Required

Apply the upstream kernel patches that restore descriptor accounting and tx_dropped updates in the bcmgenet reclaim path
Update to a stable kernel release that includes one of the fix commits referenced in the NVD entry
Reboot affected hosts after kernel updates and verify the new kernel is active using uname -r

Patch Information

Fixes have been merged into multiple Linux stable branches. Reference the upstream commits: Kernel Git Commit 150d06a, Kernel Git Commit 25ff3a3, Kernel Git Commit 3c3abbc, Kernel Git Commit 3f3168a, Kernel Git Commit 52b9f80, and Kernel Git Commit ac4a29c. Consult your Linux distribution vendor for backported packages.

Workarounds

Schedule periodic interface resets through ip link set <iface> down && ip link set <iface> up on systems that cannot be patched immediately, recognizing this causes brief network disruption
Reduce conditions that trigger TX queue reclaim by stabilizing link state and avoiding repeated driver resets where possible
Where feasible, replace the GENET interface with an alternative network path until the kernel patch is deployed

bash

# Verify running kernel and check for the bcmgenet module
uname -r
lsmod | grep bcmgenet

# Inspect interface drop counters and queue state
ip -s link show eth0
ethtool -S eth0 | grep -iE 'drop|tx_'

# After patching, confirm the fix commit is present (example for distro kernels)
rpm -q --changelog kernel | grep -E '150d06a|25ff3a3|3c3abbc|3f3168a|52b9f80|ac4a29c'