CVE-2026-53088

net: bcmgenet: fix off-by-one in bcmgenet_put_txcb

State: Published
Severity: 9.8 Critical
Published: Jun 24, 2026
Updated: Oct 19, 2026
Reserved: Jun 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net: bcmgenet: fix off-by-one in bcmgenet_put_txcb

The write_ptr points to the next open tx_cb. We want to return the tx_cb that gets rewinded, so we must rewind the pointer first then return the tx_cb that it points to. That way the txcb can be correctly cleaned up.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-193 Off-by-one Error

Affected Products

Product	Versions
LinuxLinux	876dbadd53a7102e2a84afc84ea2bd3ee6dc5636 to before 14e9f86564fff7bcf7f45c1b69080e837b31d185Affected 876dbadd53a7102e2a84afc84ea2bd3ee6dc5636 to before fb9a3c1f547d0ff024dbfe7b6f327626ddf0a3deAffected 876dbadd53a7102e2a84afc84ea2bd3ee6dc5636 to before 85f34ec320d3881badfd4edc5fee5cd5012bb54dAffected 876dbadd53a7102e2a84afc84ea2bd3ee6dc5636 to before 2a74590170427a3ca7cc4bb8690cdd559129c29cAffected 876dbadd53a7102e2a84afc84ea2bd3ee6dc5636 to before 29394f722f620281f2ee9a47f947734e53d72c90Affected 876dbadd53a7102e2a84afc84ea2bd3ee6dc5636 to before 4cab761fc51c65aef741fcece4a18f3554edbc09Affected 876dbadd53a7102e2a84afc84ea2bd3ee6dc5636 to before 72df896e31ddd06fcc5a789f025ad7a62a18bc9bAffected 876dbadd53a7102e2a84afc84ea2bd3ee6dc5636 to before 57f3f53d2c9c5a9e133596e2f7bc1c50688a6d38Affected 3bdf77194ea822390b405639b77659071fd2c2e9Affected 3.16.50 to before 3.17Affected
LinuxLinux	4.13Affected before 4.13Not affected 5.10.258 through 5.10.Not affected 5.15.209 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.141 through 6.6.Not affected 6.12.91 through 6.12.Not affected 6.18.33 through 6.18.Not affected 7.0.10 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

876dbadd53a7102e2a84afc84ea2bd3ee6dc5636 to before 14e9f86564fff7bcf7f45c1b69080e837b31d185Affected
876dbadd53a7102e2a84afc84ea2bd3ee6dc5636 to before fb9a3c1f547d0ff024dbfe7b6f327626ddf0a3deAffected
876dbadd53a7102e2a84afc84ea2bd3ee6dc5636 to before 85f34ec320d3881badfd4edc5fee5cd5012bb54dAffected
876dbadd53a7102e2a84afc84ea2bd3ee6dc5636 to before 2a74590170427a3ca7cc4bb8690cdd559129c29cAffected
876dbadd53a7102e2a84afc84ea2bd3ee6dc5636 to before 29394f722f620281f2ee9a47f947734e53d72c90Affected
876dbadd53a7102e2a84afc84ea2bd3ee6dc5636 to before 4cab761fc51c65aef741fcece4a18f3554edbc09Affected
876dbadd53a7102e2a84afc84ea2bd3ee6dc5636 to before 72df896e31ddd06fcc5a789f025ad7a62a18bc9bAffected
876dbadd53a7102e2a84afc84ea2bd3ee6dc5636 to before 57f3f53d2c9c5a9e133596e2f7bc1c50688a6d38Affected
3bdf77194ea822390b405639b77659071fd2c2e9Affected
3.16.50 to before 3.17Affected

LinuxLinux

4.13Affected
before 4.13Not affected
5.10.258 through 5.10.*Not affected
5.15.209 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.141 through 6.6.*Not affected
6.12.91 through 6.12.*Not affected
6.18.33 through 6.18.*Not affected
7.0.10 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.