CVE-2026-53088: Linux Kernel bcmgenet Off-By-One Vulnerability

CVE-2026-53088 Overview

CVE-2026-53088 is an off-by-one defect in the Linux kernel bcmgenet Ethernet driver, specifically inside the bcmgenet_put_txcb function. The driver's write_ptr references the next available transmit control block (tx_cb), but the original implementation returned the wrong entry when rewinding the pointer. As a result, the transmit control block returned to the caller did not match the slot that was actually rewound, leading to improper cleanup of transmit descriptors in the Broadcom GENET network driver.

Critical Impact
Incorrect cleanup of transmit control blocks in the bcmgenet driver can corrupt the kernel's transmit ring state on Broadcom GENET Ethernet hardware, potentially causing transmit path instability on affected Linux systems.

Affected Products

Linux kernel net/ethernet/broadcom/genet driver (bcmgenet)
Systems using Broadcom GENET Ethernet controllers (commonly Raspberry Pi 4/5 and select Broadcom SoCs)
Multiple stable Linux kernel branches (fixes backported across eight stable trees)

Discovery Timeline

2026-06-24 - CVE-2026-53088 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53088

Vulnerability Analysis

The vulnerability resides in bcmgenet_put_txcb, a helper in the Broadcom GENET driver responsible for returning a transmit control block from the driver's ring buffer. The function tracks the next free slot using write_ptr. When the driver needs to roll back the most recently advanced descriptor, it must decrement write_ptr and then return the entry it now points at. The original code returned the tx_cb at the current write_ptr before performing the rewind, producing an off-by-one mismatch between the returned descriptor and the slot the driver believed it had freed.

This mismatch corrupts the bookkeeping for transmit descriptors. Subsequent cleanup operations operate on the wrong tx_cb, leaving stale state in the actual rewound slot and prematurely releasing resources tied to an active descriptor. On a busy transmit path, this can desynchronize the producer and consumer indices of the transmit ring.

Root Cause

The root cause is an ordering error between pointer arithmetic and dereference. write_ptr always points one past the last used slot. To correctly identify the rewound tx_cb, the pointer must be decremented before being dereferenced. The pre-patch implementation reversed this order, classifying the issue as a boundary condition / off-by-one error in indexing rather than a memory-safety bug in the traditional sense.

Attack Vector

No network-reachable attack vector has been published for this issue. The defect is reachable only through the driver's internal transmit error and rewind paths, which require local kernel-driven conditions on hardware that uses the bcmgenet driver. Exploitation potential is constrained to local denial of service or transmit path corruption rather than remote code execution. The EPSS data published with the CVE reflects a low probability of weaponized exploitation.

The vulnerability is described in prose because no public proof-of-concept has been released. The corrective commits available in the kernel git tree reorder the decrement-then-return logic so that the returned tx_cb matches the slot being rewound. See the Kernel Git Commit 14e9f86 and Kernel Git Commit 85f34ec for the upstream fix.

Detection Methods for CVE-2026-53088

Indicators of Compromise

No file-based or network IOCs apply; this is an in-kernel logic defect with no published exploit signature.
Unexpected bcmgenet transmit timeouts, transmit ring stalls, or ndo_start_xmit errors logged via dmesg on Broadcom GENET hardware.
Recurring NIC resets or interface flaps on affected Linux systems running unpatched kernels.

Detection Strategies

Inventory all Linux hosts using the bcmgenet driver and verify their kernel version against the fixed stable releases referenced in the kernel.org commits.
Use configuration management tooling (Ansible, osquery, MDM) to query uname -r and module versions for bcmgenet.
Correlate kernel log entries mentioning bcmgenet transmit errors with build metadata to identify hosts running pre-patch kernels.

Monitoring Recommendations

Forward kernel ring buffer and journald logs to a centralized log platform and alert on bcmgenet transmit anomalies.
Track network interface counters (tx_errors, tx_dropped, tx_carrier_errors) on Broadcom GENET interfaces for sustained increases.
Include kernel version compliance checks for embedded and edge devices, where bcmgenet is most commonly deployed.

How to Mitigate CVE-2026-53088

Immediate Actions Required

Identify all systems using the bcmgenet driver, particularly Raspberry Pi devices and Broadcom-based embedded Linux appliances.
Apply the latest stable kernel update from your distribution that includes the upstream bcmgenet_put_txcb fix.
Reboot affected systems after patching to ensure the new kernel and driver are loaded.

Patch Information

The fix has been merged into multiple stable Linux kernel branches. Refer to the upstream commits for the exact change: Kernel Git Commit 14e9f86, Kernel Git Commit 29394f72, Kernel Git Commit 2a74590, Kernel Git Commit 4cab761, Kernel Git Commit 57f3f53, Kernel Git Commit 72df896, Kernel Git Commit 85f34ec, and Kernel Git Commit fb9a3c1.

Workarounds

No supported workaround exists short of patching, since the defect lives inside the driver's transmit path logic.
For systems that cannot be patched immediately, restrict workloads that drive heavy or error-prone transmit activity on bcmgenet interfaces.
Where alternative network hardware is available, route critical traffic through a different interface until the kernel update is deployed.

bash

# Verify kernel version and bcmgenet module on affected hosts
uname -r
modinfo bcmgenet | grep -E 'filename|version|srcversion'
# Apply distribution updates (example: Debian/Ubuntu)
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r | sed 's/[^-]*-[^-]*-//')
sudo reboot