BCMGenet Driver Off-by-One Error in Linux Kernel

Publication date: 2026-06-24

Last updated on: 2026-07-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix off-by-one in bcmgenet_put_txcb The write_ptr points to the next open tx_cb. We want to return the tx_cb that gets rewinded, so we must rewind the pointer first then return the tx_cb that it points to. That way the txcb can be correctly cleaned up.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-07-14

Generated

2026-07-15

AI Q&A

2026-06-24

EPSS Evaluated

2026-07-13

NVD

CVE-2026-53088

EUVD

EUVD-2026-38956

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is an off-by-one error in the Linux kernel's bcmgenet network driver, specifically in the function bcmgenet_put_txcb. The issue involves the write_ptr pointer, which points to the next open transmit control block (tx_cb). The code incorrectly returns the tx_cb before rewinding the pointer, causing improper cleanup of the tx_cb. The fix involves rewinding the pointer first and then returning the tx_cb it points to, ensuring correct cleanup.

Impact Analysis

An off-by-one error in the network driver's transmit control block handling could lead to improper cleanup of network transmission buffers. This might cause resource leaks, degraded network performance, or instability in the network stack. However, specific impacts such as security breaches or data corruption are not detailed.

Hi! I’m here to help you understand CVE-2026-53088. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70