CVE-2026-98051

Undergoing Analysis Undergoing Analysis - In Progress

bcmasp Driver Consecutive Descriptor Slot Availability Check Bypass

Publication date: 2026-09-25

Last updated on: 2026-10-06

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: fix tx_spb_ring_full() checking same slot cnt times The loop initialised next_index from intf->tx_spb_index on every iteration, so incr_ring() always produced the same result and only one slot was ever tested. Move the initialisation before the loop so each iteration advances next_index and the function correctly checks that cnt consecutive descriptor slots are available before allowing a new transmission.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-06

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-98051

EUVD

EUVD-2026-86704

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.19 (inc) to 7.2.7 (exc)
linux	linux_kernel	7.3
linux	linux_kernel	From 6.13 (inc) to 6.18.53 (exc)
linux	linux_kernel	7.3
linux	linux_kernel	From 6.7 (inc) to 6.12.111 (exc)
linux	linux_kernel	From 6.6 (inc) to 6.6.158 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-670	The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability in the Broadcom ASP network driver. The issue is in the tx_spb_ring_full() function where a loop incorrectly initializes next_index from tx_spb_index on every iteration. This causes the function to always check the same descriptor slot, preventing proper validation of available slots for new transmissions.

Detection Guidance

This vulnerability affects the Linux kernel's bcmasp driver for Broadcom ASICs. Detection requires checking the kernel version and bcmasp driver status. Use uname -a to verify kernel version and lsmod | grep bcmasp to check if the driver is loaded. If the driver is loaded, examine the driver code or logs for the tx_spb_ring_full function behavior.

Impact Analysis

This vulnerability could allow a local attacker to cause a denial of service by preventing new network transmissions from being queued properly. It may lead to network performance degradation or system hangs in affected systems using the bcmasp driver.

Compliance Impact

This vulnerability affects the Linux kernel's network subsystem, specifically the bcmasp driver, which could lead to incorrect handling of transmission slots. However, the provided context does not detail any direct impact on compliance with standards like GDPR or HIPAA.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the bcmasp tx_spb_ring_full() vulnerability. Monitor network traffic for unusual transmission patterns or errors related to the Broadcom ASP driver.

Hi! I’m here to help you understand CVE-2026-98051. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70