CVE-2026-98574 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, network administrators, and security teams responsible for Linux-based systems should assess exposure and prioritize patching and verification of Linux kernel versions. This includes reviewing and applying patches, monitoring network traffic and system logs, and implementing additional security measures.

Why it matters

A use-after-free vulnerability was found in the Linux kernel's bcmgenet network driver. This issue can be triggered by an MTU change, and it can be detected using KASAN. Linux kernel developers and maintainers, network administrators, and security teams responsible for Linux-based systems should assess exposure and prioritize patching and verification of Linux kernel versions.

• Potential use-after-free vulnerability in the Linux kernel's bcmgenet network driver
• Possible system crashes or instability due to the vulnerability
• Need for patching and verification of Linux kernel versions

Technical summary

The vulnerability is caused by the fact that bcmgenet_netif_stop() and the Wake-on-LAN branch of bcmgenet_suspend() both disable the Tx queues first and stop Tx NAPI several steps later. A completion in flight calls netif_tx_wake_queue() in between, and nothing stops the queue again, allowing a transmit to reach the rings after they have been freed. This issue can be triggered by an MTU change, and it can be detected using KASAN. Linux kernel developers and maintainers should assess exposure and prioritize patching and verification of Linux kernel versions.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided patches to the Linux kernel
• Monitor network traffic and system logs for potential exploitation attempts
• Consider implementing additional security measures, such as network segmentation and access controls
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was discovered in the Linux kernel's bcmgenet network driver. The issue arises from the fact that bcmgenet_netif_stop() and the Wake-on-LAN branch of bcmgenet_suspend() both disable the Tx queues first and stop Tx NAPI several steps later. A completion in flight calls netif_tx_wake_queue() in between, and nothing stops the queue again, allowing a transmit to reach the rings after they have been freed.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.