CVE-2026-98798
Received Received - Intake

NULL dereference in Linux kernel BCM GENET driver

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix NULL dereference in set_coalesce before first open The Rx ring priv and index are only set in bcmgenet_init_rx_ring(), which runs at open. Setting the Rx coalescing parameters on an interface that was never opened, e.g. "ethtool -C eth0 rx-usecs 50", dereferences a NULL ring->priv. The oops happens with RTNL held, so networking stays stuck until a reboot: Unable to handle kernel paging request at virtual address 0000000000002788 pc : bcmgenet_set_rx_coalesce.isra.0+0x10/0x88 lr : bcmgenet_set_coalesce+0xe8/0x180 Call trace: bcmgenet_set_rx_coalesce.isra.0+0x10/0x88 (P) __ethnl_set_coalesce.isra.0+0x490/0x570 ethnl_set_coalesce+0x48/0xc0 ethnl_default_set_doit+0xf4/0x230 genl_family_rcv_msg_doit+0xe8/0x160 genl_rcv_msg+0x220/0x2a0 netlink_rcv_skb+0x68/0x140 genl_rcv+0x40/0x60 netlink_unicast+0x338/0x3c0 netlink_sendmsg+0x19c/0x3f8 __sock_sendmsg+0x64/0xc0 __sys_sendto+0x124/0x198 __arm64_sys_sendto+0x30/0x48 Set priv and index at probe. Writing the registers while the interface is down is harmless because open resets the MAC and bcmgenet_init_rx_coalesce() reapplies the stored values. It was observed on a Raspberry Pi CM4, but should apply to all other genet devices.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98798
EUVD
EUVD-2026-103883

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux 9f4ca05827a27ec73bf63a42732f1978b8a779af
Linux Linux 9f4ca05827a27ec73bf63a42732f1978b8a779af
Linux Linux 9f4ca05827a27ec73bf63a42732f1978b8a779af
Linux Linux 9f4ca05827a27ec73bf63a42732f1978b8a779af
Linux Linux 4.17

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a NULL pointer dereference in the Linux kernel's bcmgenet network driver. It occurs when trying to set Rx coalescing parameters on a network interface that has never been opened. The issue arises because the Rx ring's priv and index are only initialized during the interface's first open, but the coalescing settings can be modified before that, leading to a crash when the driver attempts to access uninitialized memory.

Detection Guidance

This vulnerability can be detected by checking if the system is running a vulnerable Linux kernel version and if the bcmgenet driver is loaded. Commands like 'uname -a' to check the kernel version and 'lsmod | grep bcmgenet' to verify the driver are useful. If the driver is loaded and the kernel is vulnerable, attempting to set coalescing parameters on an unopened interface may trigger the issue.

No specific commands are provided in the context to directly detect exploitation, but monitoring kernel logs for NULL dereference errors or system crashes may indicate an issue.

Impact Analysis

This vulnerability can cause a kernel panic (oops) on affected systems, leading to a complete system crash. Since the crash occurs with the RTNL lock held, the networking stack becomes unresponsive until a reboot. It affects systems using the bcmgenet driver, such as Raspberry Pi CM4 devices, and could potentially disrupt network services.

Mitigation Strategies

Apply a kernel update that includes the fix for this vulnerability. The fix involves setting priv and index at probe time, which prevents the NULL dereference when setting coalescing parameters on an unopened interface.

Avoid running ethtool commands to set coalescing parameters on interfaces that have not been opened. Ensure all network interfaces are properly initialized before applying such settings.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98798. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart