CVE-2026-98051: Linux Kernel bcmasp TX Ring Vulnerability

CVE-2026-98051 Overview

CVE-2026-98051 is a logic flaw in the Linux kernel's Broadcom ASP 2.0 Ethernet driver (bcmasp). The tx_spb_ring_full() function reinitialized next_index from intf->tx_spb_index on every loop iteration. As a result, incr_ring() produced the same index each time and only one descriptor slot was actually tested. The function failed to verify that cnt consecutive descriptor slots were available before permitting a transmission. Upstream maintainers resolved the issue by moving the initialization outside the loop so each iteration advances next_index correctly.

Critical Impact
Incorrect ring-full accounting in the bcmasp transmit path can lead to descriptor ring corruption or dropped packets on Broadcom ASP 2.0 network interfaces running affected Linux kernels.

Affected Products

Linux kernel versions containing the bcmasp driver prior to the fix
Systems using Broadcom ASP 2.0 Ethernet controllers (common on Broadcom STB and ARM platforms)
Downstream Linux distributions that have not yet backported the stable patches

Discovery Timeline

2026-09-25 - CVE-2026-98051 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-98051

Vulnerability Analysis

The bcmasp driver manages transmit descriptors through a software producer buffer (SPB) ring. Before queuing a new frame that requires cnt descriptors, tx_spb_ring_full() must confirm that cnt consecutive slots are free. The original implementation defined next_index inside the loop body and assigned it from intf->tx_spb_index on every pass. Each call to incr_ring(next_index) therefore advanced the index from the same base value, returning the identical slot number repeatedly. The loop checked a single slot cnt times instead of walking cnt distinct descriptors. See the upstream patch 0c5cf62e for the exact code change.

Root Cause

The defect is a classic loop-variable scoping error. Initializing next_index inside the loop reset the iteration state on every pass, preventing the function from advancing through the ring. The fix hoists the initialization above the loop so each iteration continues from the previously computed index.

Attack Vector

The flaw is a kernel reliability defect in a network driver's transmit queue accounting. There is no documented remote or local attack vector that leverages it for privilege escalation. The practical consequence is incorrect ring-full detection, which can produce transmission stalls, dropped frames, or descriptor reuse under network load.

No verified proof-of-concept code is available. Refer to the kernel.org stable patch references for the authoritative source-level description.

Detection Methods for CVE-2026-98051

Indicators of Compromise

Unexplained transmit stalls or NETDEV WATCHDOG warnings on interfaces backed by the bcmasp driver
Kernel log entries referencing bcmasp transmit timeouts or ring errors under sustained outbound traffic
Discrepancies between ethtool -S transmit counters and observed throughput on Broadcom ASP 2.0 NICs

Detection Strategies

Inventory Linux hosts and embedded devices using the bcmasp module via lsmod | grep bcmasp or modinfo bcmasp
Compare running kernel versions against the fixed commits referenced in the stable kernel git tree
Flag devices where the installed kernel predates the backport of commits 0c5cf62e, 5df7ecd3, a8bddab5, or f7f7a16d

Monitoring Recommendations

Alert on repeated transmit queue timeouts (tx_timeout) reported through /sys/class/net/<iface>/statistics/
Collect kernel ring buffer messages centrally and watch for bcmasp driver warnings
Correlate network interface throughput regressions with kernel version drift across the fleet

How to Mitigate CVE-2026-98051

Immediate Actions Required

Identify systems running the bcmasp driver on Broadcom ASP 2.0 hardware
Schedule kernel updates to a stable release that includes the referenced fix commits
For embedded or STB devices, obtain updated firmware images from the device vendor incorporating the patched kernel

Patch Information

The fix has been merged into the mainline Linux kernel and backported to stable branches. Review the four stable commits: 0c5cf62e, 5df7ecd3, a8bddab5, and f7f7a16d. Install the vendor-provided kernel package that incorporates these commits for your distribution.

Workarounds

No upstream workaround is documented; applying the patched kernel is the recommended remediation
Where patching is delayed, reduce exposure by limiting sustained high-throughput transmit workloads on affected interfaces
Consider failing over traffic to a secondary interface not backed by the bcmasp driver until the host is patched

bash

# Verify whether the bcmasp driver is loaded and identify affected interfaces
lsmod | grep bcmasp
for iface in /sys/class/net/*; do
  drv=$(readlink "$iface/device/driver" 2>/dev/null)
  case "$drv" in *bcmasp*) echo "Affected interface: $(basename "$iface")" ;; esac
done

# Confirm running kernel version against the patched stable release
uname -r