CVE-2026-64125
Received Received - Intake

Buffer Overflow in Linux Kernel BCM GENET Driver

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: keep RBUF EEE/PM disabled Setting RBUF_EEE_EN | RBUF_PM_EN in RBUF_ENERGY_CTRL breaks the RX path on GENET hardware once MAC EEE becomes active. RX traffic stops flowing while the link stays up and the usual descriptor/RX error counters remain quiet. In that state the MAC still accepts frames (rbuf_ovflow_cnt keeps climbing) but RBUF no longer forwards them to DMA, so rx_packets is no longer incremented at the netdev level. On some boards the corruption ends up as a paging fault in skb_release_data via bcmgenet_rx_poll on an LPI exit. Reproduced on Pi 4B (BCM2711 + BCM54213PE) and confirmed by Florian Fainelli on an internal Broadcom 4908-family board with the same crash signature. RBUF_PM_EN is not publicly documented. This shows up more often now that phy_support_eee() enables EEE by default, but it also affects older kernels as soon as TX LPI is turned on via ethtool, so it is not specific to recent changes. Always clear RBUF_EEE_EN | RBUF_PM_EN in bcmgenet_eee_enable_set so the bits stay off across resets. UMAC and TBUF setup is left alone so TX-side EEE keeps working.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64125
EUVD
EUVD-2026-45810

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
broadcom bcmgenet *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Linux kernel's bcmgenet network driver. It occurs when RBUF_EEE_EN or RBUF_PM_EN bits are set in RBUF_ENERGY_CTRL, which disrupts the RX path on GENET hardware when MAC EEE becomes active. This causes RX traffic to stop flowing while the link remains up, and errors are not logged in standard counters. The issue leads to frames being accepted but not forwarded to DMA, causing rx_packets to stop incrementing. In some cases, it results in a paging fault during skb_release_data processing.

Detection Guidance

This vulnerability may be detected by monitoring RX traffic counters on systems using the BCM54213PE PHY with GENET hardware. Check if rx_packets stops incrementing while the link remains up and rbuf_ovflow_cnt increases. Use commands like ethtool -S <interface> to monitor RX errors and counters.

Impact Analysis

If you use a system with a BCM54213PE PHY or similar Broadcom hardware running the affected Linux kernel, network traffic may stop unexpectedly. This can disrupt network services, cause data loss, or lead to system crashes due to paging faults. The issue is more likely to occur when EEE (Energy Efficient Ethernet) is enabled, either by default or via ethtool.

Compliance Impact

This vulnerability affects network traffic handling in the Linux kernel's bcmgenet driver, which could lead to data transmission failures without clear error indicators. While it does not directly impact compliance with standards like GDPR or HIPAA, it may cause data processing or transmission issues that could indirectly affect compliance if critical data is lost or improperly handled during network operations.

Mitigation Strategies

Apply a kernel patch that clears RBUF_EEE_EN and RBUF_PM_EN bits in bcmgenet_eee_enable_set. Disable EEE on affected interfaces using ethtool -s <interface> eee off. Monitor RX traffic to ensure normal operation after changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64125. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart