CVE-2026-64125
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
In the bcmgenet driver for Broadcom chips, a vulnerability causes RX traffic to stall after EEE activation. Setting RBUF_EEE_EN and RBUF_PM_EN bits in RBUF_ENERGY_CTRL prevents RBUF from forwarding frames to DMA, stopping rx_packets increment and potentially causing a paging fault. Reproduced on Pi 4B and Broadcom 4908-family boards.
Risk Assessment
The organization may experience incoming traffic disruption without visible link errors, complicating diagnosis. In extreme cases, a system crash (paging fault) can occur when processing a packet after LPI exit.
Recommendation
Apply the Linux kernel patch that clears RBUF_EEE_EN and RBUF_PM_EN bits in bcmgenet_eee_enable_set immediately. If the patch is unavailable, temporarily disable EEE on Broadcom network interfaces using ethtool.
Other vulnerabilities in Linux kernel
See all- CVE-2026-80923Unknown
In the Linux kernel, in the xhci: dbgtty driver, if tty_register_driver() fails, it drops the reference but fails to set the global dbc_tty_driver to NULL, causing the unregister to be called again when the module exits. This leads to a use-after-free condition.
- CVE-2026-80922Unknown
In the Linux kernel, in the crypto: qcom-rng module, the random number generator does not allow zero as an output, making its output distinguishable from truly random. Zero is a valid random number and should be allowed.
- CVE-2026-80920Unknown
In the Linux kernel, in io_uring, eventfd signaling is done inline when adding the first entry to the work list, which can cause issues when the addition is done from a wakeup handler context. The fix adds the IOU_F_TWQ_IN_WAKE flag to force deferral of signaling via call_rcu_hurry() instead of inline signaling.
- CVE-2026-80919Unknown
In the Linux kernel, a vulnerability was found in the amdgpu driver where amdgpu_devcoredump_format() recursively acquires a ww_mutex lock. This can lead to a deadlock when dumping IB contents from a hung job. The fix moves the operation to a separate helper using a single drm_exec context.
- CVE-2026-80918Unknown
In the Linux kernel, in HID: core, there is a number/pointer type confusion on long items. When fetch_item() is called by hid_scan_report() on an item with HID_ITEM_TAG_LONG, it stores a pointer to the item data in item->data.longdata instead of storing a value directly. Functions item_udata() and item_sdata() incorrectly assume short format, leading to the lower part of a kernel pointer being printed as a number in dmesg.
- CVE-2026-80917Unknown
A vulnerability in the Linux kernel causes a NULL pointer dereference in the PCI host-generic driver on 32-bit systems using CAM mode. During PCI bus enumeration, the first config read uses an uninitialized mapping, leading to a kernel panic. The issue stems from missing add_bus/remove_bus callbacks in the CAM operations, which are necessary for proper mapping of the config space.
- CVE-2026-80916Unknown
A vulnerability in the Linux kernel's KCOV mechanism causes data corruption and race conditions on PREEMPT_RT systems. The issue stems from storing temporary KCOV state in per-CPU areas, which can be overwritten by nested softirq preemption. Additionally, under certain initialization conditions, it may lead to kernel panic or memory leaks.
- CVE-2026-80915Unknown
In the Linux kernel, the drm/xe driver's DPT allocation paths were fixed. The fallback from VRAM to system memory was removed as it did not work and caused black screen with pipe faults. Also, stolen memory usage is avoided due to latency and risk of random system hangs under load.
- CVE-2026-80886Unknown
In the Linux kernel, a vulnerability in the msm serial driver was fixed by disabling DMA for the console UART. Concurrent writes from userspace and the kernel can trigger a race condition resulting in an infinite loop of the same messages. The fix disables DMA for the console UART to ensure a reliable output path.
- CVE-2026-80885Unknown
In the Linux kernel, a fix was made for an uncancelled rxrpc OOB message handler in AFS. The fix cancels OOB message processing (typically to respond to security challenges) and moves it to afs_wq so it is also waited for. The OOB handler now returns if the net namespace is no longer live.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: keep RBUF EEE/PM disabled Setting RBUF_EEE_EN | RBUF_PM_EN in RBUF_ENERGY_CTRL breaks the RX path on GENET hardware once MAC EEE becomes active. RX traffic stops flowing while the link stays up and the usual descriptor/RX error counters remain quiet. In that state the MAC still accepts frames (rbuf_ovflow_cnt keeps climbing) but RBUF no longer forwards them to DMA, so rx_packets is no longer incremented at the netdev level. On some boards the corruption ends up as a paging fault in skb_release_data via bcmgenet_rx_poll on an LPI exit. Reproduced on Pi 4B (BCM2711 + BCM54213PE) and confirmed by Florian Fainelli on an internal Broadcom 4908-family board with the same crash signature. RBUF_PM_EN is not publicly documented. This shows up more often now that phy_support_eee() enables EEE by default, but it also affects older kernels as soon as TX LPI is turned on via ethtool, so it is not specific to recent changes. Always clear RBUF_EEE_EN | RBUF_PM_EN in bcmgenet_eee_enable_set so the bits stay off across resets. UMAC and TBUF setup is left alone so TX-side EEE keeps working.