CVE-2026-99192
Received Received - Intake

BaseFortify

Publication date: 2026-10-28

Last updated on: 2026-10-28

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: unshare the skb before writing the control block bcmgenet stores first_cb, last_cb and bytes_sent in the skb control block and reads them back on completion to free the skb and credit BQL. ether_setup() leaves IFF_TX_SKB_SHARING set, so the stack can resubmit a shared skb that is still in the ring. The next transmit overwrites last_cb, so the earlier slots complete without crediting their bytes and BQL stalls the queue until the watchdog resets it. Unshare the skb before writing the control block. Reproduce with pktgen in clone_skb mode, which hands the driver the same skb while earlier copies are still in the ring: modprobe pktgen pg=/proc/net/pktgen echo "add_device eth0" > $pg/kpktgend_0 echo "dst_mac AA:BB:CC:DD:EE:FF" > $pg/eth0 echo "dst 192.0.2.1" > $pg/eth0 echo "clone_skb 8" > $pg/eth0 echo "count 0" > $pg/eth0 echo start > $pg/pgctrl & sleep 5 echo stop > $pg/pgctrl wait cat /sys/class/net/eth0/queues/tx-0/byte_queue_limits/inflight inflight stays nonzero on the now idle queue. clone_skb 0 leaves it at zero.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-28
Last Modified
2026-10-28
Generated
2026-10-28
AI Q&A
2026-10-28
EPSS Evaluated
N/A
NVD
CVE-2026-99192
EUVD
EUVD-2026-111944

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
Linux Linux f48bed16a756f5bc0244acd581f61968f7d7c2a4
Linux Linux f48bed16a756f5bc0244acd581f61968f7d7c2a4
Linux Linux f48bed16a756f5bc0244acd581f61968f7d7c2a4
Linux Linux fb4ca2b4bc6712a6ad635df5b9b41131846589f9
Linux Linux 3.16.50
Linux Linux 4.13

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves the bcmgenet network driver. The driver incorrectly shares skb control blocks between transmissions, causing the queue to stall. When a shared skb is reused before earlier copies complete, the driver overwrites control data, preventing proper cleanup and credit allocation for transmitted bytes. This leads to the Byte Queue Limit (BQL) system stalling the queue until a watchdog reset occurs.

Detection Guidance

To detect this vulnerability, check if the byte queue limits (BQL) inflight counter remains non-zero on an idle queue. Use the command: cat /sys/class/net/eth0/queues/tx-0/byte_queue_limits/inflight. If the value is non-zero, it may indicate the issue.

Impact Analysis

This vulnerability can cause network performance issues on affected systems using the bcmgenet driver. It may lead to stalled network queues, reduced throughput, or temporary loss of network connectivity until the watchdog resets the queue. Systems under heavy network load are most affected.

Mitigation Strategies

Apply the Linux kernel patch that resolves this issue. Disable skb sharing by ensuring IFF_TX_SKB_SHARING is not set for the affected network interface.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-99192. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart