CVE-2026-64125
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
In the bcmgenet driver for Broadcom chips, a vulnerability causes RX traffic to stall after EEE activation. Setting RBUF_EEE_EN and RBUF_PM_EN bits in RBUF_ENERGY_CTRL prevents RBUF from forwarding frames to DMA, stopping rx_packets increment and potentially causing a paging fault. Reproduced on Pi 4B and Broadcom 4908-family boards.
Risk Assessment
The organization may experience incoming traffic disruption without visible link errors, complicating diagnosis. In extreme cases, a system crash (paging fault) can occur when processing a packet after LPI exit.
Recommendation
Apply the Linux kernel patch that clears RBUF_EEE_EN and RBUF_PM_EN bits in bcmgenet_eee_enable_set immediately. If the patch is unavailable, temporarily disable EEE on Broadcom network interfaces using ethtool.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: keep RBUF EEE/PM disabled Setting RBUF_EEE_EN | RBUF_PM_EN in RBUF_ENERGY_CTRL breaks the RX path on GENET hardware once MAC EEE becomes active. RX traffic stops flowing while the link stays up and the usual descriptor/RX error counters remain quiet. In that state the MAC still accepts frames (rbuf_ovflow_cnt keeps climbing) but RBUF no longer forwards them to DMA, so rx_packets is no longer incremented at the netdev level. On some boards the corruption ends up as a paging fault in skb_release_data via bcmgenet_rx_poll on an LPI exit. Reproduced on Pi 4B (BCM2711 + BCM54213PE) and confirmed by Florian Fainelli on an internal Broadcom 4908-family board with the same crash signature. RBUF_PM_EN is not publicly documented. This shows up more often now that phy_support_eee() enables EEE by default, but it also affects older kernels as soon as TX LPI is turned on via ethtool, so it is not specific to recent changes. Always clear RBUF_EEE_EN | RBUF_PM_EN in bcmgenet_eee_enable_set so the bits stay off across resets. UMAC and TBUF setup is left alone so TX-side EEE keeps working.