CVE-2026-98798: Linux Kernel bcmgenet Use-After-Free

CVE-2026-98798 Overview

CVE-2026-98798 is a NULL pointer dereference vulnerability in the Linux kernel's Broadcom GENET Ethernet driver (bcmgenet). The flaw resides in the receive coalescing configuration path and triggers when userspace sets Rx coalescing parameters on a network interface that has never been opened. The kernel oops occurs with the RTNL lock held, which leaves networking stuck until the system is rebooted. The issue was observed on a Raspberry Pi CM4 but applies to all other GENET-based devices.

Critical Impact
A local user with CAP_NET_ADMIN can trigger a kernel NULL pointer dereference by issuing ethtool -C <iface> rx-usecs <value> against a never-opened GENET interface, causing a denial of service that persists until reboot.

Affected Products

Linux kernel versions containing the bcmgenet driver prior to the fix
Broadcom GENET-based Ethernet controllers (including Raspberry Pi CM4 and similar platforms)
Downstream distributions shipping the vulnerable kernel versions

Discovery Timeline

2026-10-18 - CVE-2026-98798 published to the National Vulnerability Database
2026-10-21 - Last updated in the NVD database

Technical Details for CVE-2026-98798

Vulnerability Analysis

The vulnerability is a NULL pointer dereference ([CWE-476]) in the bcmgenet_set_rx_coalesce function of the Linux kernel's Broadcom GENET Ethernet driver. The Rx ring's priv pointer and index field are populated exclusively inside bcmgenet_init_rx_ring(), which runs during the interface open path. When userspace invokes the ethtool coalesce setter against an interface that has never been brought up, the driver traverses an uninitialized ring structure and dereferences a NULL ring->priv.

The resulting kernel oops occurs while the Routing Netlink (RTNL) lock is held. Because the lock is never released, subsequent networking operations block indefinitely. Recovery requires a full system reboot. The call path leading to the fault starts in the generic netlink ethtool handler (ethnl_set_coalesce) and reaches the driver through __ethnl_set_coalesce.

Root Cause

The root cause is a lifetime mismatch between driver probe and interface open. Ring metadata needed by the coalesce configuration helpers is initialized only during bcmgenet_init_rx_ring() at open time, yet the ethtool coalesce interface is exposed to userspace as soon as the netdev is registered at probe. Any configuration request that arrives between probe and the first open touches uninitialized ring state.

Attack Vector

Exploitation requires local access to the system and the CAP_NET_ADMIN capability to invoke ethtool against the target interface. An attacker runs a command such as ethtool -C eth0 rx-usecs 50 against a GENET interface that has never been opened. The kernel oops is triggered immediately, locking the RTNL mutex and stalling the networking stack. No code execution or privilege escalation primitive has been demonstrated; the impact is a persistent denial of service against networking until reboot.

The upstream fix moves initialization of priv and index into the probe path. Writing the hardware registers while the interface is down is safe because bcmgenet_open() resets the MAC, and bcmgenet_init_rx_coalesce() reapplies the stored values.

Detection Methods for CVE-2026-98798

Indicators of Compromise

Kernel oops entries in dmesg or /var/log/kern.log referencing bcmgenet_set_rx_coalesce.isra.0 in the program counter.
Call traces that include __ethnl_set_coalesce, ethnl_set_coalesce, and genl_rcv_msg immediately preceding a paging request fault.
Networking becoming unresponsive on a GENET-equipped host with no successful recovery short of reboot.

Detection Strategies

Inventory running kernel versions on Broadcom GENET hardware (notably Raspberry Pi 3/4/CM4 and derivatives) and compare against the fixed stable commits.
Correlate audit or auditd records for ethtool invocations with subsequent kernel panics on affected systems.
Monitor netlink traffic for ETHTOOL_MSG_COALESCE_SET requests directed at interfaces that have never transitioned to IFF_UP.

Monitoring Recommendations

Forward kernel ring buffer events to a centralized logging platform and alert on Unable to handle kernel paging request strings paired with bcmgenet symbols.
Track network interface state transitions on embedded fleets to flag long-lived interfaces that remain administratively down yet receive ethtool configuration changes.
Alert on RTNL-related stalls, such as sustained hangs in rtnl_lock observed via /proc/<pid>/stack on networking daemons.

How to Mitigate CVE-2026-98798

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the kernel.org stable commits for your kernel branch.
Restrict access to the CAP_NET_ADMIN capability so only trusted administrators can invoke ethtool configuration against GENET interfaces.
Ensure every GENET interface is brought up at boot before any configuration tooling attempts to set coalescing parameters.

Patch Information

The fix is distributed across the following stable kernel commits, which move Rx ring priv and index initialization from bcmgenet_init_rx_ring() into the probe path: 0d867b91598b, 19419faf58df, 213ff02ab26a, 2294b62eaec6, and d870102b5425. Update to a kernel release that incorporates the commit matching your stable branch.

Workarounds

Bring GENET interfaces administratively up with ip link set <iface> up before applying any ethtool coalescing parameters.
Remove or guard automation and configuration-management scripts that call ethtool -C against interfaces whose link state has not been verified.
Where feasible, disable or unbind the bcmgenet driver on systems that do not require the interface until a patched kernel is deployed.

bash

# Configuration example: ensure the interface is up before setting coalescing
ip link set eth0 up
ip link show eth0 | grep -q 'state UP' && ethtool -C eth0 rx-usecs 50