Skip to main content

CVE-2026-98574

Microsoft — net: bcmgenet: stop Tx NAPI before disabling the queues

Microsoft · Not classified by connected sources

Patch Tuesday
0

EVRS 0 of 100 Informational

Monitor

Rank 2,863 of 2,960 tracked

Download PDF

Why it scores 0

Evidence available: 2 of 8 signals

No strong exploitation, disclosure, or severity signal is available for this CVE yet.

  • CISA KEVDid not apply
  • RansomwareNo data
  • Vendor exploitationNo data
  • EPSSDid not apply
  • Microsoft Exploitability IndexNo data
  • Pre-patch disclosureNo data
  • KEV recencyNo data
  • CVSSNo data

The band answers “how soon”, not “how bad”. No data for: Ransomware, Vendor exploitation, Microsoft Exploitability Index, Pre-patch disclosure, KEV recency, CVSS. Why some signals show no data

Fix

No fixed version identified yet

Affected versions

Not identified by the connected sources

Remediation

NVD lists one or more references for this CVE that aren't tagged as a patch or vendor advisory. Review them directly to confirm patch availability and applicability before making a remediation decision.

Evidence

Each value with its source
MeasureValueSource
CVSS base scoreHow severe the flaw is in itself. It does not say how likely an attack is. Not publishedNVD and the CVE record were checked and hold no score. NVD
FIRST EPSSFIRST's estimate of the chance this is exploited in the next 30 days, and how that ranks against all CVEs. 0.002 (9th pctl) FIRST EPSS
Actively exploitedWhether a source of record has confirmed attacks using it in the wild. Not confirmed Patch Tuesday
Public exploit moduleA module existing is not the same as active exploitation. None known Metasploit
EUVD cross-referenceENISA's record: CVSS 0.0, assigned by Linux. Listed ENISA EUVD

Description

NVD

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: stop Tx NAPI before disabling the queues bcmgenet_netif_stop() and the Wake-on-LAN branch of bcmgenet_suspend() both disable the Tx queues first and stop Tx NAPI several steps later. A completion in flight calls netif_tx_wake_queue() in between, and nothing stops the queue again, so a transmit can reach the rings after they have been freed. Close is safe because dev_deactivate_many() stops the qdisc first. bcmgenet_suspend() does not, so stop Tx NAPI before the queues on both paths. KASAN on a Raspberry Pi CM4, driven from an MTU change because suspend freezes user space before the callback runs: BUG: KASAN: use-after-free in bcmgenet_xmit+0x17f8/0x2258 Write of size 8 at addr ffffff8055844a68 by task ksoftirqd/0/14 bcmgenet_xmit+0x17f8/0x2258 dev_hard_start_xmit+0x13c/0x588 sch_direct_xmit+0x108/0x340 __dev_queue_xmit+0x1190/0x3848