CVE-2026-64125: Linux Kernel Privilege Escalation Bug

CVE-2026-64125 Overview

CVE-2026-64125 is a Linux kernel vulnerability in the Broadcom GENET Ethernet driver (bcmgenet). Setting RBUF_EEE_EN | RBUF_PM_EN in RBUF_ENERGY_CTRL breaks the receive path on GENET hardware once MAC Energy-Efficient Ethernet (EEE) becomes active. The receive buffer stops forwarding frames to Direct Memory Access (DMA) while the MAC continues to accept them, causing rbuf_ovflow_cnt to climb without rx_packets incrementing. On some boards the condition escalates to a paging fault in skb_release_data via bcmgenet_rx_poll on a Low Power Idle (LPI) exit.

Critical Impact
The flaw can trigger a kernel paging fault on affected Broadcom GENET-based systems, resulting in loss of network connectivity or system crash once EEE or TX LPI is active.

Affected Products

Linux kernel builds containing the bcmgenet driver with phy_support_eee() enabling EEE by default
Broadcom BCM2711 platforms with BCM54213PE PHY (for example, Raspberry Pi 4B)
Broadcom 4908-family boards using GENET hardware

Discovery Timeline

2026-07-19 - CVE-2026-64125 published to the National Vulnerability Database (NVD)
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64125

Vulnerability Analysis

The defect resides in the bcmgenet_eee_enable_set function of the Broadcom GENET driver. The driver programs RBUF_EEE_EN and RBUF_PM_EN bits in the RBUF_ENERGY_CTRL register when the MAC negotiates EEE. Once these bits are set and MAC EEE becomes active, the RBUF block silently stops forwarding received frames into the DMA engine. The link remains up, standard descriptor counters stay quiet, and only the internal rbuf_ovflow_cnt counter reflects the drop.

On some hardware the transition out of Low Power Idle triggers memory corruption that surfaces as a paging fault in skb_release_data called from bcmgenet_rx_poll. The condition is reproducible on Raspberry Pi 4B with BCM2711 and BCM54213PE, and has been confirmed on an internal Broadcom 4908-family board.

Root Cause

The undocumented RBUF_PM_EN bit interacts poorly with active MAC EEE, gating traffic between the RBUF and DMA stages. Enabling it in RBUF_ENERGY_CTRL violates the assumption that RX flow continues to operate while the MAC is in LPI. The classification aligns with a kernel driver logic flaw producing a null pointer or invalid pointer dereference during LPI exit.

Attack Vector

The fault surfaces during normal operation once TX LPI is enabled via ethtool or once phy_support_eee() activates EEE by default. Network-adjacent conditions that keep the interface active across LPI transitions are sufficient to trigger the receive-path stall and, on affected boards, the paging fault. No authenticated interaction with the host is required to induce the traffic pattern that leads to the crash.

The upstream fix always clears RBUF_EEE_EN | RBUF_PM_EN in bcmgenet_eee_enable_set so the bits stay off across resets, while leaving UMAC and TBUF setup intact so TX-side EEE continues to function. See the Linux kernel stable commit for the reference implementation.

Detection Methods for CVE-2026-64125

Indicators of Compromise

Interface link remains up but rx_packets at the netdev layer stops incrementing while traffic is being sent to the host.
The rbuf_ovflow_cnt counter reported by the bcmgenet driver climbs continuously without corresponding descriptor errors.
Kernel oops or paging fault stack traces referencing skb_release_data and bcmgenet_rx_poll after an LPI transition.

Detection Strategies

Monitor ethtool -S <iface> output for divergence between MAC-level accepted frames and DMA-level rx_packets on GENET interfaces.
Collect kernel log entries via dmesg or journalctl -k for BUG:, Unable to handle paging requests, or oops traces containing bcmgenet_rx_poll.
Audit installed kernel versions on Broadcom GENET hardware and compare against the fixed commit set published on kernel.org.

Monitoring Recommendations

Alert on Broadcom GENET hosts where the interface reports a live link but zero received packets for a sustained interval.
Ship kernel crash artifacts and netdev statistics to a centralized log store to correlate LPI events with RX stalls.
Track EEE state changes via ethtool --show-eee <iface> on managed fleets that include Raspberry Pi 4B or Broadcom 4908-family devices.

How to Mitigate CVE-2026-64125

Immediate Actions Required

Update affected systems to a Linux kernel build that includes the bcmgenet fix clearing RBUF_EEE_EN | RBUF_PM_EN in bcmgenet_eee_enable_set.
Inventory Broadcom GENET-based devices such as BCM2711 and 4908-family boards to prioritize patch rollout.
Validate that TX-side EEE still operates after patching, since only the RBUF bits are cleared by the fix.

Patch Information

The fix is available in the upstream Linux stable tree. Reference commits include 2040eb83f6ad, 289499907399, 3d4ef05266ab, 49bdf6bbb21b, 9a1730245e41, a212fc08f5c4, b579f3a73da7, and f2782ddac82c.

Workarounds

Disable EEE on affected interfaces using ethtool --set-eee <iface> eee off until the kernel patch is applied.
Avoid enabling TX LPI via ethtool on unpatched Broadcom GENET hosts.
Pin fleets running Raspberry Pi 4B or Broadcom 4908-family boards to kernel builds where phy_support_eee() does not auto-enable EEE, then upgrade to the fixed kernel.

bash

# Disable EEE on a bcmgenet interface until the kernel is patched
sudo ethtool --set-eee eth0 eee off

# Verify EEE state
ethtool --show-eee eth0

# Confirm running kernel after patching
uname -r